How Do I View Login Logs of a Windows ECS?
Scenarios
This section describes how to view the login logs of a Windows ECS.
Procedure
The following operations are performed on an ECS running Windows Server 2012.
- Log in to the Elastic Cloud ServiceECS.
- Choose Start > Administrative Tools > Event Viewer.
- On the Event Viewer window, choose Windows Logs > Security > Filter Current Logs.
- Filter events with ID 4776 to obtain remote login logs.
You can also view login attempts by filtering events with ID 4624 or 4625.
- 4624: ID of successful login events
- 4625: ID of failed login events
- Right-click an event and choose Event Properties from the shortcut menu. The logon account of the event is displayed.
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.