Ciriy: Windows 远程登陆日志

2022年6月7日星期二

参考：

https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625

https://blog.csdn.net/C_chuxin/article/details/84974207

大量 Special Logon 是什么

This is due to SYSTEM account which every couple of seconds try to logon. It is perfectly normal. So, don't worry.

Special Logon

事件查看器的 Windows - RemoteDesktopServices-RdpCoreTS 事件日志查看具有IP地址的连接尝试。