Understand Logon Session in Windows
I always put the refs first so here you go:
https://www.youtube.com/watch?v=9S-ZucC_9r4&ab_channel=SANSCyberDefense (First talk that makes me look into Logon Session)
https://jsecurity101.medium.com/better-know-a-data-source-logon-sessions-1291538bb3a3 (same guys but will teach you how to track login session)
Logon Session
Basically, every time you log in to the system (your windows machine), it will generate a session ID and if you are a high-privilege user (such as Admin) then you have 2 session IDs
In Presentation, it looks like this
Last updated
Was this helpful?