How to unsubscribe from Windows Event ID

August 22, 2020 by Jimmie Bourn


Here are some simple steps you can take to fix your Windows Event ID login problem. This event has event ID 21 (Remote Desktop Services: Session connection established successfully). These events can be found in Applications and Services Logs -> Microsoft -> Windows -> TerminalServices-LocalSessionManager -> Operational. As you can see, the RDP user session ID is listed here.



4624 Examples

Windows 10 And 2016

Does Windows log an event when a user logs off a Windows computer?

When a user shuts down their computer, Windows cannot log the shutdown event until the system restarts. Therefore, some logout events are logged much later than when they actually occur.

The account was successfully registered.

Account Name: DESKTOP-LLHJ389 $
Account domain: WORKGROUP
Record ID: 0x3E7

Registration information:
Registration type: 7
Limited Admin Mode: -
Virtual account: no
Increased token: no

Identity theft: Identity theft

New registration:
SID: AzureAD \ RandyFranklinSmith
Account name: [email protected]
Account domain: AzureAD
Record ID: 0xFD5113F
Associated Login: 0xFD5112A
Network account name: -
Network account domain: -
Registration GUID: {00000000-0000-0000-0000-000000000000}

Process information:
Process ID: 0x30c
Process name: C: \ Windows \ System32 \ lsass.exe

Network Information:
Workstation name: DESKTOP-LLHJ389
Source network address: -
Source port: -

Details of authentication:
Registration process: negotiations
Authentication Package: Negotiation
Transit services: -
Package name (NTLM only): -
key length: 0


Account Name: WIN-R9H529RIO4Y $
Account domain: WORKGROUP
Connection ID: 0x3e7
Post type: 10
New entry:
SID: WIN-R9H529RIO4Y \ Admin
Account Name: Administrator
Account domain: WIN-R9H529RIO4Y
Record ID: 0x19f4c
Registration GUID: {00000000-0000-0000-0000-000000000000}
Process Information:
Process ID: 0x4c0
Process name: C: \ Windows \ System32 \ winlogon.exe
Network Information:
Workstation name: WIN-R9H529RIO4Y
Source network address:
Source Port: 1181
Authentication Details:
Registration procedure: User32
Authentication package: negotiationora
Transit services: -
Package name (NTLM only): -
Key length: 0

This event is generated when a login session is created. It is generated on a computer to which we had access.

The subject fields indicate the account on the local system that requested the connection. Most often, this is a service such as a server service or a local process such as Winlogon.exe or Services.exe.

What is logon type 3 in Event Viewer?

Connection type 3: network. A user or computer connected to this computer from a network. The description of this type of connection clearly shows that the event was logged when someone accessed the computer over the network. Usually displayed when connecting to shared resources (shared folders, printers, etc.).

The Post Type field specifies the post type. The most common types are 2 (interactive) and 3 (network).

The New Entry fields indicate the account for which the new entry was created, ie. H. the account that was linked.

The network fields indicate where the dial-up connection request came from. The workstation name is not always available and in some cases can be left blank.


Top 10 Windows security events to watch out for

windows event id logon

Free event collection toolWindows







Related posts:

  1. Object Access Event Id Windows 2008

    4656 examples Win2008 Examples A handle to an object was requested. Topic: SID: WIN-R9H529RIO4Y \ Administrator Account Name: Administrator Account domain: WIN-R9H529RIO4Y Record ID: 0x1fd23 Theme: Object Server: Security Object type: File Object Name: C: \ Users \ Administrator \ Testfolder \ New Text Document.txt Descriptor ID: 0xb8 Process Information: Process ID: 0xed0 Process name: C: \ Windows \ System32 \ ...
  2. User Error Message Event Class

    Member Function Documentation QMessageBox :: QMessageBox (QMessageBox :: Symbol-Symbol, const QString & Title, const QString & Text, QMessageBox :: StandardButtons-Buttons = NoButton, QWidget * parent = nullptr , Qt :: WindowFlags f = Qt :: Dialog | Qt :: MSWindowsFixedSizeDialogHint) Creates a message box with the specified icons, titles, text, and standard buttons. Standard or custom buttons can be added at any time using addButton (). The parent and f arguments are passed to the QDialog constructor. If the macOS parent is not nullptr and you want your message box to appear as ...
  3. Windows Update Download Directory Windows 7

    The size of the folder where Windows update files are stored becomes an issue for users. The largest consumer of disk space on Windows clients is all obsolete and redundant files that are installed in component memory and are stored in the WinSxS directory. If you are wondering whether it is safe to clear Windows Update cache files or clean Windows updates that are no longer needed on your computer, our first suggestion is to delete Windows Update files. for this reason, it should ONLY be used as a last resort. It is generally not recommended to manually change ...
  4. How Do I Know What Windows Installer Version I Have

    Windows 10 ISO files downloaded from Microsoft have descriptive names such as B. en_windows_10_pro_10586_x64_dvd.iso and en_windows_10_pro_14393_x86_dvd.iso , depending on the variant downloaded. The file name indicates the language, version, assembly version, and suitability of the operating system contained in the ISO. Suppose you have a copy of a Windows ISO with a common name such as windows_10.iso that you received from a friend. You can use the DISM tool to find your Windows version, create it, and create it from an ISO file or Windows installation DVD. Find Windows version, compilation and ...
  5. Windows Ce 5.0 Video Codec Windows CE 5.0 (codenamed "Macallan" because it is operated by Magellan-branded GPS devices.) [2] is the successor to Windows CE 4.2, the third version of Windows IT. NET Family. It was first released on July 9, 2004. Like its predecessors, Windows CE 5.0 has been released for the embedded and third-party device markets. Windows CE 5.0 is marketed as a low-cost, compact and fast-to-market real-time operating system available for x86, ARM, MIPS and SuperH microprocessor systems. Windows CE 5.0 builds on previous versions of Windows CE using a common source. Microsoft has been extending the original Windows ...
  6. Best Free Antivirus For Pc Windows Xp

    With the development of the digital space today, it is surprising that many people still do not see the need for antivirus software. Every day we hear new stories about how individuals and companies are exposed to digital threats and lose some of their personal data and information to online thieves and fraudsters. While virus protection should extend to Mac and Windows users, those who work on Windows computers should be more careful about what happens on their PCs. This is why we explain in this article why Windows XP antivirus protection is highly justified in today's technology context. ...
  7. Restore Registry In Windows

    The Registry is probably the most important database in Windows 10 and contains all the system settings your computer and applications need to function properly. Generally, it is never recommended to make any changes to this database, as the slightest mistake can cause stability and startup problems. However, if you really need to edit the registry to personalize the user experience, it's a good idea to back up your entire database in case something goes wrong and you need to roll back your changes. While there are several ways (including third party tools) to back up this ...
  8. Create A Scheduler In Windows

    In Windows 10, Task Scheduler is a tool that lets you automatically create and start almost any task. Typically, the system and some applications use the scheduler to automate maintenance tasks such as defragmenting the hard drive, cleaning up the hard drive, and updating. However, everyone can use it. This allows you to launch applications, run commands and run scripts on a specific day and time, or launch tasks when a specific event occurs. Task Scheduler keeps track of the time and events on your computer and runs the task as soon as the condition is met. ...
  9. How To Block Uploading In Windows 7

    Windows 10 uses Delivery Optimization to quickly download updates to your device from multiple sources other than Microsoft, including random PCs over the Internet and over the network. local. However, if you join this peer-to-peer network, it also means that Windows 10 uses your internet connection to download updates to other PCs. While this mechanism helps reduce data usage to keep systems up to date and prevents Windows Update service from being overloaded, you may need to disable this feature in certain scenarios. For example, if you don't like the idea of ​​Microsoft using your Internet. You are ...
  10. Can You Run Dos Programs In Windows 7 Xp Mode

    October surprise - so many people interpret Microsoft's 11th Hour report that it will provide a virtualized copy of Windows XP as a free add-on for compatibility with Windows 7 Professional, Ultimate, and Enterprise editions. The idea is to encourage potential update vendors to take the plunge in Windows 7 by solving one of the most frequently reported product issues - it will wipe out older applications from the Windows XP era. And judging by the amount of hype surrounding this unexpected new feature, it looks like Microsoft has had a success by announcing Windows XP Mode. ...