Windows Forensic Handbook
Search
Ctrl + K
Username
EventID 4624: An account was successfully logged on
AutomaticDestinations Jumplists
EventID 21: Session logon succeeded
EventID 24: Session has been disconnected
EventID 1149: User Authentication Succeeded
Last updated
6 months ago