WinLogonAuditor — Windows logon, lockout & logoff auditing

Everything you need to triage a logout storm

Built around the real incident workflow: see the full picture, narrow to one user and a time window, then trace the source.

📋

Full searchable list

One sortable grid across the Security and System logs. Quick-filter box narrows thousands of rows instantly.

🔎

Search by user

Wildcards supported — jsmith, svc-*, *admin*. Filter on the server side and live in the grid.

🕑

Any timeframe

Presets from 1 hour to 7 days, or a precise custom from/to date range.

🔐

Lockout Investigator

Enter a locked user; it surfaces the event 4740 caller computer and the correlated failed logons holding the stale credential.

🚪

Logout Analyzer

Groups logoff / disconnect / lock / lockout / reboot activity per user and names the likely cause.

🌍

Plain-English decoding

Logon types, NTSTATUS / SubStatus and Kerberos failure codes translated — no more decoding 0xC000006A by hand.

📊

Summary dashboard

Counts by category, top users by failures, top source hosts/IPs by failures.

🖥️

DC auto-discovery

Saved server list plus one-click discovery of every domain controller (using your domain creds) — auto-selects the PDC emulator, or query all DCs at once. Read-only.

⬇️

Export & auto-refresh

CSV export for tickets, 60-second auto-refresh, plus a headless CLI mode for scheduled triage.

What it looks like

Dark, dense and functional — the grid is the product.

TimeIDResultCategory / User / Reason

2026-05-18 09:14:024740LockoutACCOUNT LOCKOUT · jsmith · Locked by: SALES-LT-07

2026-05-18 09:13:584625FailureFAILED Logon · jsmith · 0xC000006A - Wrong password · src 10.20.4.61

2026-05-18 09:13:554771FailureKerberos Pre-Auth FAILED · jsmith · 0x18 - bad password

2026-05-18 08:02:114624SuccessSuccessful Logon · jsmith · 10 - RemoteInteractive (RDP)

2026-05-18 07:55:401074InfoSystem Shutdown/Restart Initiated · FILESRV01

Quick start

No .NET SDK and no modules to install. Grab the standalone exe, or run the script directly — either way it's portable.

Option A — the exe (easiest)

Download WinLogonAuditor.exe from the latest release.
Right-click it → Run as administrator (needed to read the Security log).
It auto-discovers your DCs; choose a time range and click Run Query.
Open the Logout Analyzer tab and scan the Likely cause column.

Option B — run the script

Copy the WinLogonAuditor folder to your DC or a domain-joined admin machine.
Right-click Run-WinLogonAuditor.cmd → Run as administrator.
Set Target to your DC name, choose a time range, click Run Query.

Investigating an active lockout: open Lockout Investigator, type the username, hit Trace lockout source — you get the caller computer from event 4740 plus the last failed-logon source host/IP.

Headless / scheduled triage

.\src\WinLogonAuditor.ps1 -Cli -Target DC01 -User jsmith -Hours 48 -OutFile triage.csv

Event IDs it understands

ID	Meaning	Class	Log
`4624`	Successful logon (approval)	Success	Security
`4625`	Failed logon	Failure	Security
`4634 / 4647`	Logoff / user-initiated sign-out	Info	Security
`4740`	Account lockout (caller computer = source)	Lockout	Security
`4767`	Account unlocked	Success	Security
`4768 / 4769 / 4771`	Kerberos TGT / service ticket / pre-auth failed	Failure	Security
`4776`	NTLM credential validation	Success	Security
`4778 / 4779`	RDP session reconnected / disconnected	Info	Security
`4800 / 4801`	Workstation locked / unlocked	Info	Security
`1074 / 6005 / 6006`	Shutdown-restart / boot / clean stop	Info	System
`6008 / 41`	Unexpected shutdown / kernel-power crash	Failure	System