Login validation events
Login validation events are the events of the Credential validation results. While logon events such as 4624, 4625, and 4672 are recorded on the workstation that the user tried to log into, the login validation events are logged by the system responsible for authenticating the credentials. So, in the case of domain account authentications, the domain controller serves as the authentication server and logs the login validation events, while in the case of local account authentications, the workstation authenticates the logon credentials using the local SAM database and the logon validation events are recorded in the workstation itself. Such events are valuable for tracking local account authentication attempts in your organization.
Microsoft records logon validation events based on the user authentication protocols used, which could be either NTLM or Kerberos. Let’s take a closer look at each of these in detail.
