Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 8:00:15 AM Event ID: 4624 Task Category: Logon Level: Information User: CORP\svc-sqldb Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 5 (Service). Account: svc-sqldb. Source Network Address: -. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:01:33 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: administrator. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:01:34 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: administrator. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:01:35 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: admin. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:01:36 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: admin. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:01:37 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:01:38 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:01:39 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Failure Reason: Unknown user name or bad password. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:02:05 AM Event ID: 4624 Task Category: Logon Level: Information User: CORP\jsmith Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 10 (RemoteInteractive). Account: CORP\jsmith. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:05:12 AM Event ID: 4624 Task Category: Logon Level: Information User: CORP\jsmith Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 3 (Network). Account: CORP\jsmith. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:10:44 AM Event ID: 4720 Task Category: User Account Management Level: Information User: CORP\jsmith Computer: DC01.corp.local Description: A user account was created. New Account Name: svc-update. New Account Domain: CORP. Created by: CORP\jsmith. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:10:52 AM Event ID: 4732 Task Category: Security Group Management Level: Information User: CORP\jsmith Computer: DC01.corp.local Description: A member was added to a security-enabled local group. Group Name: Administrators. Member: CN=svc-update,CN=Users,DC=corp,DC=local. Added by: CORP\jsmith. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:11:30 AM Event ID: 4732 Task Category: Security Group Management Level: Information User: CORP\jsmith Computer: DC01.corp.local Description: A member was added to a security-enabled local group. Group Name: Remote Desktop Users. Member: CN=svc-update,CN=Users,DC=corp,DC=local. Added by: CORP\jsmith. Log Name: System Source: Service Control Manager Date: 10/10/2025 9:15:03 AM Event ID: 7045 Task Category: None Level: Information User: CORP\jsmith Computer: DC01.corp.local Description: A service was installed in the system. Service Name: WindowsUpdateHelper. Service File Name: C:\Windows\Temp\svc-helper.exe. Service Type: user mode service. Service Start Type: auto start. Service Account: LocalSystem. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:15:05 AM Event ID: 4624 Task Category: Logon Level: Information User: NT AUTHORITY\SYSTEM Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 5 (Service). Account: LocalSystem. Source Network Address: -. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:20:11 AM Event ID: 4624 Task Category: Logon Level: Information User: CORP\svc-update Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 10 (RemoteInteractive). Account: CORP\svc-update. Source Network Address: 10.0.14.88. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 9:22:33 AM Event ID: 4624 Task Category: Logon Level: Information User: CORP\svc-update Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 3 (Network). Account: CORP\svc-update. Source Network Address: 10.0.14.88. Workstation: DC01. Accessing: \\DC01\C$ Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 10:00:15 AM Event ID: 4624 Task Category: Logon Level: Information User: CORP\svc-sqldb Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 5 (Service). Account: svc-sqldb. Source Network Address: -. Workstation: DC01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 10:05:22 AM Event ID: 4625 Task Category: Logon Level: Information User: N/A Computer: DC01.corp.local Description: An account failed to log on. Logon Type: 3 (Network). Account: CORP\svc-update. Failure Reason: Account locked out. Source Network Address: 10.0.14.88. Workstation: FILESRV01. Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/10/2025 11:00:01 AM Event ID: 4624 Task Category: Logon Level: Information User: CORP\administrator Computer: DC01.corp.local Description: An account was successfully logged on. Logon Type: 2 (Interactive). Account: administrator. Source Network Address: 172.16.0.5. Workstation: DC01.