Windows event log ยท System7001 User logon
- System
- 1 field
System.evtxMicrosoft-Windows-Winlogon
Fields EvtxECmd extracts
1 column in the EvtxECmd CSV
- PayloadData1
UserSID: %UserSid%- %UserSid% = /Event/EventData/Data[@Name="UserSid"]
Sample event
Event XML from the map file
<Event>
<System>
<Provider Name="Microsoft-Windows-Winlogon" Guid="dbe9b456-7cf3-4331-91cc-a3cb1234b538"/>
<EventID>7001</EventID>
<Version>0</Version>
<Level>4</Level>
<Task>1901</Task>
<Opcode>0</Opcode>
<Keywords>0x2000200000900000</Keywords>
<TimeCreated SystemTime="2020-06-10 05:23:32.9946381"/>
<EventRecordID>62316</EventRecordID>
<Correlation/>
<Execution ProcessID="16788" ThreadID="1896"/>
<Channel>System</Channel>
<Computer>HOSTNAME.domain.com</Computer>
<Security UserID="S-1-5-18"/>
</System>
<EventData>
<Data Name="TSId">6</Data>
<Data Name="UserSid">S-1-5-21-795675957-65754735-9675674874-7637643</Data>
</EventData>
</Event>References
3 links
- superuser.com/questions/726967/how-can-i-know-if-someone-has-logged-into-my-account-in-windows-7(opens in new tab)
- community.spiceworks.com/topic/2131335-ps-script-for-user-logon-activity-7001-7002-and-4800-4001-need-help(opens in new tab)
- superuser.com/questions/767143/find-out-why-pc-just-restarted-for-no-reason?newreg=e76b115fee3b486fb76788c3b4906677(opens in new tab)
Source: evtx/Maps/System_Microsoft-Windows-Winlogon_7001.map(opens in new tab) by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)