Security Log Event ID 4624 Auditing - Few Questions

Question

I am working on a PowerShell script that collects Event ID's 4624 with LogonType 10 (Logon)  and Event ID's 4647 (Logoff). This is basically keeping an audit trail of logon's and logoff's of users on our terminal services environment. 
This is working as expected, however, I am seeing two things that I have remaining questions on:
For the Logon Event ID 4624...for a few users, I am seeing two Logon Event's created. They are exactly the same, except one has a LogonGuid of all 0's : {00000000-0000-0000-0000-000000000000}. 
Why would there be two Logon events created where one of them has a LogonGuid of all 0's? For the correlating Logoff event, it is tied to the Logon Event with the all 0's LogonGuid. I would expect the logoff event to
be ties to the LogonGuid that isn't all 0's. 
If a user disconnects (not logoff), and when they logon again, another logon event is created. Is there anyway to decipher from a completely new logon event and from a logon event to resume a disconnected session?

Answer 1

Hi mabrito,
I assume you meeting the following scenario event.
When a user logon, two events get logged with event id 4624. the only difference between them is followings:-
Logon GUID: 
{00000000-0000-0000-0000-000000000000}
Logon GUID: 
{user GUID }
Logon GUID: {00000000-0000-0000-0000-000000000000} is for anything other than Kerberos, Logon GUID is a unique identifier that can be used to correlate this event with a KDC
event.
You can refer the following article:
Deciphering Account Logon Events
http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447934.aspx
I’m glad to be of help to you!
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]