TimeCreated	EventID	EventName	TargetAccount	LogonType	AuthPackage	SourceIP	Workstation	Status
2026-06-18T08:01:11	4624	An account was successfully logged on	administrator	2	Kerberos	10.0.0.15	DC01	Success
2026-06-18T08:14:02	4624	An account was successfully logged on	jdoe	2	Kerberos	10.0.0.51	FIN-WS07	Success
2026-06-18T08:30:45	4634	An account was logged off	jdoe	2	Kerberos	10.0.0.51	FIN-WS07	Success
2026-06-18T09:00:00	4625	An account failed to log on	admin	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:01:07	4625	An account failed to log on	test	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:02:14	4625	An account failed to log on	root	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:03:21	4625	An account failed to log on	guest	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:04:28	4625	An account failed to log on	sql	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:05:35	4625	An account failed to log on	oracle	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:06:42	4625	An account failed to log on	backup	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:07:49	4625	An account failed to log on	administrator	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:08:56	4625	An account failed to log on	user	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:09:03	4625	An account failed to log on	ftp	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:10:10	4625	An account failed to log on	web	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:11:17	4625	An account failed to log on	svc	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:12:24	4625	An account failed to log on	operator	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:13:31	4625	An account failed to log on	helpdesk	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:14:38	4625	An account failed to log on	admin	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:15:45	4625	An account failed to log on	test	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:16:52	4625	An account failed to log on	root	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:17:59	4625	An account failed to log on	guest	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:18:06	4625	An account failed to log on	sql	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:19:13	4625	An account failed to log on	oracle	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:20:20	4625	An account failed to log on	backup	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:21:27	4625	An account failed to log on	administrator	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:22:34	4625	An account failed to log on	user	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:23:41	4625	An account failed to log on	ftp	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:24:48	4625	An account failed to log on	web	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:25:55	4625	An account failed to log on	svc	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:26:02	4625	An account failed to log on	operator	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:27:09	4625	An account failed to log on	helpdesk	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:28:16	4625	An account failed to log on	admin	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:29:23	4625	An account failed to log on	test	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:30:30	4625	An account failed to log on	root	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:31:37	4625	An account failed to log on	guest	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:32:44	4625	An account failed to log on	sql	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:33:51	4625	An account failed to log on	oracle	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:34:58	4625	An account failed to log on	backup	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:35:05	4625	An account failed to log on	administrator	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:36:12	4625	An account failed to log on	user	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T09:37:19	4625	An account failed to log on	ftp	3	NTLM	10.0.0.240	FIN-WS07	0xC000006A
2026-06-18T11:02:03	4625	An account failed to log on	svc_backup	3	NTLM	203.0.113.77	FIN-WS07	0xC000006A
2026-06-18T11:02:19	4625	An account failed to log on	svc_backup	3	NTLM	203.0.113.77	FIN-WS07	0xC000006A
2026-06-18T11:03:41	4624	An account was successfully logged on	svc_backup	3	NTLM	203.0.113.77	FIN-WS07	Success
2026-06-18T11:03:42	4672	Special privileges assigned to new logon	svc_backup	3	NTLM	203.0.113.77	FIN-WS07	Success
2026-06-18T11:07:55	4720	A user account was created	support_adm	0	-	203.0.113.77	FIN-WS07	Success
2026-06-18T11:08:10	4732	A member was added to a security-enabled local group	support_adm	0	-	203.0.113.77	FIN-WS07	Administrators
2026-06-18T11:15:30	4624	An account was successfully logged on	svc_backup	3	NTLM	203.0.113.77	FIN-DB02	Success
2026-06-18T12:00:00	4624	An account was successfully logged on	administrator	2	Kerberos	10.0.0.15	DC01	Success
2026-06-18T13:22:14	4625	An account failed to log on	jdoe	2	Kerberos	10.0.0.51	FIN-WS07	0xC000006A