In the logon event ID table, which event ID represents a successful logging on to a computer?

In the logon event ID table, which event ID represents a successful logging on to a computer?

• A. 528
• B. 529
• C. 530
• D. 531

Answer: (A)

Logon event IDs in Windows Security logs mark authentication outcomes. The one that shows a successful logon to the computer is 528. When this event is recorded, it means a user successfully authenticated and gained access on that machine, with details such as user name, domain, logon type, and source workstation often included. The other IDs in the same group indicate different results (such as failed attempts or other non-successful logon scenarios), so they do not represent a successful logon. On newer systems, you’d also see a successful logon logged with a corresponding modern ID (like 4624) in the Security log, but historically 528 is the indicator of a successful logon in that logon event ID table.

Logon event IDs in Windows Security logs mark authentication outcomes. The one that shows a successful logon to the computer is 528. When this event is recorded, it means a user successfully authenticated and gained access on that machine, with details such as user name, domain, logon type, and source workstation often included. The other IDs in the same group indicate different results (such as failed attempts or other non-successful logon scenarios), so they do not represent a successful logon. On newer systems, you’d also see a successful logon logged with a corresponding modern ID (like 4624) in the Security log, but historically 528 is the indicator of a successful logon in that logon event ID table.