Windows Server Event Logs Dashboard

System / Application / Security • Light Theme • Reports + Events + Sessions

Loading…
Critical
—
Errors
—
Warnings
—
Total
—
Reports are shown below in the same page: Events • Login/Logout • Sessions • Failed Logins • Top Providers.
Time Server Channel Level Event Provider Message
Loading events…
Tip: schedule collector every 2–5 minutes for near real-time ingest.
Rows: 0
Login / Logout Events
Security • 4624/4634/4647/4778/4779
Time Server Type User LogonType IP Event Info
Loading…
Disconnect (4779) is NOT logout; Logout is 4647; Session end is 4634.
Rows: 0
Quick Stats
Last 24h
  • Logins (4624)
    —
  • Logouts (4647)
    —
  • Session End (4634)
    —
  • RDP Disconnect (4779)
    —
  • RDP Reconnect (4778)
    —
Sessions (paired by LogonId)
LOGIN 4624 ↔ END 4634/4647
Server User LogonType IP Login Logout/End Status LogonId
Loading…
If logout/end missing, status shows “ACTIVE/UNKNOWN”.
Rows: 0
Sessions (paired by LogonId)
LOGIN 4624 ↔ END 4634/4647
Server User LogonType IP Login Logout/End Session Time Status LogonId
Loading…
If logout/end missing, status shows “ACTIVE/UNKNOWN”.
Rows: 0
Failed Login Attempts
Security • 4625
Time Server User IP Event Message
Loading…
Use this for brute-force monitoring.
Rows: 0
Top Providers
Counts by provider
Server Channel Provider Count
Loading…
Helps identify noisy sources quickly.
Rows: 0