Understanding reasons behind 4624 event id with logon type 2 and immediately followed by 4624 logon type 2

N

Nathan Bob

Hi,

I understand 4624 logon type 2 is for interactive but a normal user logon to the workstation that records 4624 logon type 2 and then immediately it logs 4624 logon type 3 in less than a minute even though no auto shared drive mapping.


I understand one of the reasons usually is due to auto or manual shared drive mapping but what are other possible scenarios where it would be logged in this sequences? Please list them out. It appears very common in corporate environment as it seems to be occurring for many users. Your insight on possible other scenarios apart from shared drive, would be helpful.

Continue reading...
 
Back
Top Bottom