Event ID 4648: A logon was attempted using explicit credentials
Windows Event ID Lookup: What Windows event IDs mean: 4625, 4624, 4740, 6008, 41, 7045, 1102 and 3,000 more, with Windows' own message text, the fields and what to check.
Look up a Windows event ID from Event Viewer, a SIEM alert or a log export: what it means, the fields it records, and what to
check. Many IDs are used by more than one source (event 41 is both a Kernel-Power crash and a boot error), so every definition
is shown, the one people usually mean first. The message text is Windows' own, read from the event providers of
Windows 10.0.26200.0, 2026-10-28; the notes are ours, based on Microsoft's
security auditing reference.
A process used explicit credentials, for example runas, a mapped drive with another user, or a scheduled task running as someone else.
What to check: Check Account Whose Credentials Were Used and Target Server Name. Lateral movement often shows up here as an admin account used against many servers.
A logon was attempted using explicit credentials.
Subject:
Security ID: …
Account Name: …
Account Domain: …
Logon ID: …
Logon GUID: …
Account Whose Credentials Were Used:
Account Name: …
Account Domain: …
Logon GUID: …
Target Server:
Target Server Name: …
Additional Information: …
Process Information:
Process ID: …
Process Name: …
Network Information:
Network Address: …
Port: …
This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.