On remote computers, it is imperative to check for unauthorized logons to protect the network from potential. A system administrator would need to track users last logon date and time to identify stale accounts, if any, in the organizations Active Directory. The Process Name identifies the program executable that accessed the object. How to generate and export the last logged on users on remote computers report. Process ID is the process ID specified when the executable started as logged in 4688. Handle ID allows you to correlate to other events logged (Open 4656, Access 4663, Close 4658)

Hanlde ID: is a semi-unique (unique between reboots) number that identifies all subsequent audited events while the object is open.

Object Value Name: The name of the registry value within the key that is being accessed.

Object Name: The name of the registry key being accessed.

As the name implies, this was created several years ago during the XP era and although it does also work on Windows Vista, 7, 8 and 10, there is a major limitation. This is the registry key and value upon whom the action was attempted. IntelliAdmin’s XP User Hide is another tool that was created to add and remove user name entries from the UserAssist registry key. Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

Logon ID is a semi-unique (unique between reboots) number that identifies the logon session.

Such activity is not something you want to go unnoticed, and you would.

Account Domain: The domain or - in the case of local accounts - computer name. Or maybe theyre trying to logon with your user account by guessing your password.

The user and logon session that performed the action.

Free Active Directory Change Auditing Solution.

Windows Event Collection: Supercharger Free Edtion.

Free Security Log Quick Reference Chart.

Of course this event will only be logged if the key's audit policy is enabled for Set Value permission for the appropriate user or a group in the user is a member. See Operation Type to find out if the value was created, modified or deleted.

This event is logged between the open ( 4656) and close ( 4658) events for the registry KEY where the value resides. This event documents creation, modification and deletion of registry VALUES.

Last logged on user registry