Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 8:00:15 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          CORP\svc-sqldb
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 5 (Service). Account: svc-sqldb. Source Network Address: -. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:01:33 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: administrator. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:01:34 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: administrator. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:01:35 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: admin. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:01:36 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: admin. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:01:37 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:01:38 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:01:39 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:02:05 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          CORP\jsmith
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:05:12 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          CORP\jsmith
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 3 (Network). Account: CORP\jsmith. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:10:44 AM
Event ID:      4720
Task Category: User Account Management
Level:         Information
User:          CORP\jsmith
Computer:      DC01.corp.local
Description:   A user account was created. New Account Name: svc-update. New Account Domain: CORP. Created by: CORP\jsmith.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:10:52 AM
Event ID:      4732
Task Category: Security Group Management
Level:         Information
User:          CORP\jsmith
Computer:      DC01.corp.local
Description:   A member was added to a security-enabled local group. Group Name: Administrators. Member: CN=svc-update,CN=Users,DC=corp,DC=local. Added by: CORP\jsmith.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:11:30 AM
Event ID:      4732
Task Category: Security Group Management
Level:         Information
User:          CORP\jsmith
Computer:      DC01.corp.local
Description:   A member was added to a security-enabled local group. Group Name: Remote Desktop Users. Member: CN=svc-update,CN=Users,DC=corp,DC=local. Added by: CORP\jsmith.

Log Name:      System
Source:        Service Control Manager
Date:          10/10/2025 9:15:03 AM
Event ID:      7045
Task Category: None
Level:         Information
User:          CORP\jsmith
Computer:      DC01.corp.local
Description:   A service was installed in the system. Service Name: WindowsUpdateHelper. Service File Name: C:\Windows\Temp\svc-helper.exe. Service Type: user mode service. Service Start Type: auto start. Service Account: LocalSystem.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:15:05 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          NT AUTHORITY\SYSTEM
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 5 (Service). Account: LocalSystem. Source Network Address: -. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:20:11 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          CORP\svc-update
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 10 (RemoteInteractive). Account: CORP\svc-update. Source Network Address: 10.0.14.88. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 9:22:33 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          CORP\svc-update
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 3 (Network). Account: CORP\svc-update. Source Network Address: 10.0.14.88. Workstation: DC01. Accessing: \\DC01\C$

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 10:00:15 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          CORP\svc-sqldb
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 5 (Service). Account: svc-sqldb. Source Network Address: -. Workstation: DC01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 10:05:22 AM
Event ID:      4625
Task Category: Logon
Level:         Information
User:          N/A
Computer:      DC01.corp.local
Description:   An account failed to log on. Logon Type: 3 (Network). Account: CORP\svc-update. Failure Reason: Account locked out. Source Network Address: 10.0.14.88. Workstation: FILESRV01.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/10/2025 11:00:01 AM
Event ID:      4624
Task Category: Logon
Level:         Information
User:          CORP\administrator
Computer:      DC01.corp.local
Description:   An account was successfully logged on. Logon Type: 2 (Interactive). Account: administrator. Source Network Address: 172.16.0.5. Workstation: DC01.
