QuestionQ86

VerifiedEvent Search

You need to perform a routine hunt for failed logins in your environment, specifically targeting Remote Interactive Logins.

Which query will accomplish this task?

Explanation

Windows defines logon type 10 as RemoteInteractive, used for remote Terminal Services or Remote Desktop sessions. UserLogon filtered with LogonType=10 therefore targets Remote Interactive logon activity, whereas logon type 3 represents network logons.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!