Logon Activity

%3CLINGO-SUB%20id%3D%22lingo-sub-677663%22%20slang%3D%22en-US%22%3ELogon%20Activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-677663%22%20slang%3D%22en-US%22%3E%3CP%3EWe%20are%20trying%20to%20view%20when%20a%20user%20logged%20onto%20a%20computer%20by%20typing%20in%20their%20user%20name%20and%20password.%26nbsp%3B%20I%20understand%20that%20this%20is%20an%20interactive%20logon.%26nbsp%3B%20ATA%20reports%20the%20user%20performing%20interactive%20logons%20at%20various%20times%20of%20the%20night%20and%20on%20to%20the%20mail%20server%20which%20is%20unlikely.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EDo%20I%20have%20the%20right%20definition%20of%20interactive%20logons%20or%20is%20ATA%20looking%20at%20something%20different%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-677663%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdvanced%20Threat%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-683321%22%20slang%3D%22en-US%22%3ERe%3A%20Logon%20Activity%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-683321%22%20slang%3D%22en-US%22%3E%3CP%3EHi%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F356535%22%20target%3D%22_blank%22%3E%40toneyrome%3C%2FA%3E%26nbsp%3B%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYes%2C%20you%20have%20the%20right%20definition.%26nbsp%3B%20Interactive%20logon%20a.k.a.%20logon%20locally%20is%20an%20account%20logging%20on%20via%20the%20console%20or%20performing%20a%20runas.%26nbsp%3B%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Highlighted
Occasional Visitor

We are trying to view when a user logged onto a computer by typing in their user name and password.  I understand that this is an interactive logon.  ATA reports the user performing interactive logons at various times of the night and on to the mail server which is unlikely.

 

Do I have the right definition of interactive logons or is ATA looking at something different?

1 Reply
Highlighted

Hi @toneyrome ,

 

Yes, you have the right definition.  Interactive logon a.k.a. logon locally is an account logging on via the console or performing a runas.