Direct answer
Event 4648 records an attempt using explicitly supplied credentials. Identify the initiating process, account, target and related session before attributing intent.
Understand the observation
Microsoft notes that explicit credential attempts occur in normal batch and RunAs workflows as well as other situations. An attempt is not itself a successful logon or proof of credential theft. Check whether the device is expected to run jobs under a separate identity.
Reference: Microsoft: Security event 4648.
Capture the context
Record the device, initiating subject, target account, server, process and time where available. A logon GUID can help correlate related events when populated; check device, time and the provider documentation before joining records. Keep account and host details in restricted evidence.
Compare with approved jobs
A scheduled backup job can legitimately use a designated service account. An interactive utility attempting an unrelated privileged account outside a change window should be checked with the owner and security team. Compare the task definition and deployment history without running the task.
Determine the outcome
Correlate with relevant successful and failed logons and preserve any uncertainty about missing records. Escalate unexplained behavior without reproducing it using real credentials or exposing secrets in a ticket. If a stale job is responsible, coordinate a supported correction and monitor its next run.
Assessment limits
Fields and correlation identifiers may be missing or vary across systems. The event alone does not prove the target authenticated successfully.
Frequently asked questions
Does 4648 mean the target account signed in successfully?
No. It records an attempt with explicit credentials; correlate the outcome separately.
Can scheduled tasks be a legitimate cause?
Yes. Compare the task, account and timing with approved operations.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.