How Do I View Login Logs of a Windows ECS?

Scenarios

This section describes how to view the login logs of a Windows ECS.

Procedure

The following operations are performed on an ECS running Windows Server 2012.

1. Log in to the Elastic Cloud ServiceECS.
2. Choose Start > Administrative Tools > Event Viewer.

   

3. On the Event Viewer window, choose Windows Logs > Security > Filter Current Logs.

   

4. Filter events with ID 4776 to obtain remote login logs.
   

   You can also view login attempts by filtering events with ID 4624 or 4625.

   • 4624: ID of successful login events
   • 4625: ID of failed login events

   

5. Right-click an event and choose Event Properties from the shortcut menu. The logon account of the event is displayed.