Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I monitor EventID 4768 on an Active Directory server to catch user logons. So far so good ... I observed that all events with user set to $ are computers.

My problem is, that as far as I can see, I am allowed to set usernames like 'abc$'. So differentiating based on '$' is not the best way.

I also can't see any other difference between 2 events, one from computer and one from user logon.

So, how to safely differentiate between users and computers when I am catching logon events?

share|improve this question

I've had better luck monitoring different Event ID numbers for login/logout events. These are ID's 4624 (login) and 4634 (logout), the two can be correlated through the LogonGUID attribute on both of them. Another pair of ID's that are useful: 4625 (failed login) and 4740 (account lockout).

share|improve this answer
Yeah, but those are user logins. A user may login but I can imagine situations where a TGT key is refused. So I prefer monitoring TGT Keys because they are more useful for my purpose. Plus, logouts can not be reliably monitored. Using TGT keys you have key granting and key refresh moments with a key expiration time. This way I am more certain which user what rights has at the specific moment on the network. – Patkos Csaba Apr 26 '11 at 9:24

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.