> For the complete documentation index, see [llms.txt](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ajmal-anwar.gitbook.io/zyberspace-by-ajmal/zyberlab/03-windows-security-basics/successful-logons.md).

# Successful Logons

## Objective

Generate a normal successful domain logon and identify the corresponding Windows security event.

## Lab System

Use `CLIENT01` with the domain user created earlier, such as:

```
ZYBERLAB\labuser01
```

## Steps

### 1. Sign Out

On `CLIENT01`, sign out of the current session.

### 2. Sign In with the Domain User

Sign in using the lab domain account.

For example:

```
ZYBERLAB\labuser01
```

Use the password created for the lab account.

### 3. Open Event Viewer

After sign-in, open:

```
Event Viewer
└── Windows Logs
    └── Security
```

### 4. Filter for Event ID 4624

Select **Filter Current Log** and enter:

```
4624
```

Review recent events around the time of the sign-in.

### 5. Inspect the Event

Look for fields such as:

* Account Name
* Account Domain
* Logon ID
* Logon Type
* Workstation Name
* Source Network Address, if present

For an interactive sign-in at the computer console, you may commonly see **Logon Type 2**. Other authentication methods can produce different logon types.

## What Happened?

Windows recorded a successful logon event because the supplied credentials were accepted and a logon session was created.

## Security Relevance

A successful logon is normal by itself. Security analysis becomes important when the context is unusual, for example:

* an administrator account signing in unexpectedly
* a user signing in at an unusual time
* a logon from an unfamiliar computer or address
* repeated successful logons following many failures

## Key Takeaways

* Event ID 4624 represents a successful logon.
* Logon type helps explain how the sign-in occurred.
* A successful event is not automatically safe or suspicious; context determines its significance.