FREE COURSE / SELF-PACED LEARNING

Windows Sign-In Evidence: Investigating Authentication Across Hosts

Interpret Windows logon, Kerberos and NTLM evidence across hosts in this free sign-in investigation course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
3 modules · 6 lessons
Estimated reading
18 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Explain the difference between credential validation, authentication, a Windows logon session, and later resource access.
  • Locate and interpret common logon and account-logon events on endpoints, servers, and domain controllers.
  • Reconstruct Kerberos and NTLM activity while accounting for protocol, logging, and field limitations.
  • Build a corroborated sign-in timeline and write a disposition based on expected behavior, impact, and confidence.

Is this the right course for you?

Who it’s for

Analysts who understand basic identity concepts and want to reconstruct Windows authentication activity.

Scope and boundaries

Authentication evidence and cross-host timelines. Event IDs alone do not prove intent, authorization or subsequent resource access.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Windows and Active Directory basics — Learners should recognize users, computers, domain controllers, and Security event logs. Packet-level protocol expertise and domain-administrator access are not required.

About this course

This course teaches SOC analysts, Windows administrators, and incident responders how Windows authentication becomes evidence across several systems. Learners build a mental model of credentials, authentication, logon sessions, tokens, and resource access; interpret common Security log events; reconstruct Kerberos and NTLM activity; and correlate host, domain-controller, network, and identity telemetry. The course treats event IDs as records with placement, fields, and collection limits rather than universal verdicts. Completion means the learner can investigate a suspicious sign-in, explain where supporting events should exist, distinguish common administrative and service behavior from meaningful anomalies, and hand off a scoped, time-aligned assessment.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. Build the Sign-In Evidence Model

Understand what Windows creates during sign-in and why related records appear on different computers with different identifiers.

  1. From Credentials to a Windows Logon SessionTrace the path from an authentication attempt to a local session and avoid equating every credential event with an interactive desktop sign-in.3 min reading
  2. Place Events on the Computer That Knows the FactMap endpoint, resource-server, and domain-controller records so absence on one system is not mistaken for absence everywhere.3 min reading

MODULE 2

2. Interpret Kerberos and NTLM Evidence

Reconstruct the two dominant Active Directory authentication paths and recognize what ticket and credential-validation events cannot reveal alone.

  1. Reconstruct Kerberos Ticket ActivityConnect ticket-granting ticket requests, service tickets, and target-host logons without claiming a ticket request equals successful resource use.3 min reading
  2. Interpret NTLM Validation and FallbackRead NTLM credential-validation evidence, identify its missing destination context, and investigate why NTLM was used before assigning intent.3 min reading

MODULE 3

3. Investigate and Make the Decision

Turn distributed audit records into a bounded timeline, then use baselines and counter-evidence to decide whether access was expected, suspicious, or confirmed unauthorized.

  1. Build a Cross-Host Authentication TimelineJoin failures, tickets, successes, privileges, processes, and resource access while preserving source-specific time and identifier limits.3 min reading
  2. Baseline, Escalate, and Document the FindingMeasure deviations against peer and historical behavior, assess impact separately, and write a sign-in disposition that another analyst can reproduce.3 min reading

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.