Important Windows event IDs for AD
You read a domain controller’s security log (JSON) with jq, count events by ID, separate logon types and failed logons, and find account creation, group addition and log clearing events; at the end you work out yourself who did a night-time incident, from where and in what order. The incident is different in every lab.
Level 201 · 45 min
Windows records every important security operation as an event, and each kind of event has a number: 4624 successful logon, 4625 failed logon, 4720 account created, 4728 member added to a global security group, 1102 security log cleared… Defence teams know these numbers by heart. The figure shows the most important ones.
In real organisations these events are sent to a SIEM (central logging and alerting system) and stored as JSON. In your lab, the security log of the CORP.LAB DC for 11 March 2026 is in ~/logs/security.jsonl: one event per line.
jq is a tool that filters and formats JSON data. Because the field names contain dots (event.code), we write them in quotes: ."event.code". In the first steps the commands are ready; then you type them by hand, and at the end you solve the incident yourself.
What you will do in this lesson
- A first look at the log
- Count the events by ID
- Failed logons: 4625
- Logon types: LogonType
- Account and group changes
- Erased tracks: 1102
- Who, and whom?
- From where?
- The timeline
- Short quiz
Skills you will earn
- Reading and counting a security log with jq
- Reading failed logons and their reasons (4625, SubStatus)
- Telling logon types apart (LogonType 2, 3, 10)
- Finding account and group change events (4720, 4728)
- Catching the log-cleared event (1102)
- Answering who, whom, from where and when for an incident
- Writing audit findings into a report
← Object permissions (ACLs) and dangerous rights · Active Directory security: auditing and hardening · Detecting password spraying →
Start for free