Problem overview
Unauthorized or unexpected administrator logins can be a major security risk, potentially indicating compromised credentials or suspicious activity. Monitoring these logins in real-time allows IT professionals and MSPs to detect potential security breaches, ensure compliance with security policies, and proactively address unauthorized access attempts before they escalate.
<#
This resource is provided as a convenience for Level users. We cannot
guarantee it will work in all environments. Please test before deploying
to your production environment. We welcome contributions to our community
library
# Level Library
# https://level.io/library/script-windows-admin-login-alert
#>
# Define known system accounts to ignore
$SystemAccounts = @("DWM-1", "DWM-2", "DWM-3", "UMFD-0", "UMFD-1", "UMFD-2", "UMFD-3", "SYSTEM")
# Get recent successful logins (Event ID 4624) and filter for interactive/RDP logins
$Logins = Get-WinEvent -FilterHashtable @{
LogName = 'Security'
ID = 4624
StartTime = (Get-Date).AddHours(-1) # Filter for the last 1 hours
} | Where-Object {
# Extract logon type
$LogonType = $_.Properties[8].Value
# Only check interactive (2) and remote desktop (10) logins
$LogonType -eq 2 -or $LogonType -eq 10
} | ForEach-Object {
$_.Properties[5].Value # Extract the account name
} | Where-Object { $_ -notin $SystemAccounts } | Select-Object -Unique
# Output detected logins
Write-Host "Detected Admin Logins: $($Logins -join ', ')"
exit 0This script scans Windows Event Logs for successful administrator logins (Event ID 4624) within the past hour, specifically filtering for interactive (local console) and remote desktop (RDP) logins. It excludes known system accounts to reduce false positives and outputs a list of detected logins. When paired with a script-based monitor in Level, this script can trigger real-time alerts whenever an admin login occurs, helping IT teams maintain strict oversight of privileged account usage.
Script
unknown node
Use cases
- Detect unauthorized or unexpected admin logins in real-time.
- Monitor privileged account activity to enhance security and compliance.
- Track remote desktop access for security auditing.
- Reduce the risk of compromised admin credentials by receiving immediate alerts.
Recommendations
- Pair with a script-based monitor in Level to automatically trigger alerts for new admin logins.
- Test before deploying in a production environment to ensure compatibility with your setup.
- Adjust system account exclusions as needed to avoid false positives.
- Regularly review logs and alerts to identify patterns of unauthorized access attempts.
- Integrate with other security tools to automate responses to suspicious login activity.