Trying to find user actions in Windows EventLog - Properties...

Hey,

we had a little incident where a user added an email account to a shared desktop pc. The target user was not an individual user but also a shared one (operational nessecity) - I tried to find out when the account was added without success (the user was deleted at the time it was reported and on all the default paths there are no ost files or whatsoever only the files of the default mailaccount on this pc.

So I tried to use the eventlog but... wow... - I have found out that I need to monitor 2 event ids in general - 5379 (after inital login the credentails are saved and read from the credentialmanager) and 4624 (Logon with type 2 or 7 since remote access is forbidden).

But I cannot find any useful information. Since the mails are also polled in background and every pull seems to create its own event wheater the user interferes or not... BUT I found some differences -

And here is also my question:
Event ID 5379 has a property named "type" and there is 1 or 0 as value. Regarding to chatgpt it is the value used to differ between automatic or background activity and user / induced activity... But i cannot find any validation for this information...
According to google (gemini...) it is not used for the type of interaction but as a respnse code (1 = error) -> but also with type = 1 the property "countOfCredentialsReturned" is 1 and there is a "returnCode" property...

Does anybody know if the "type" property is used to decide if it is background or direct interaction?

Hey all,

we recently encountered a minor incident where a user added an email account to a shared desktop PC. The target user was also a shared (non-individual) account, used for operational purposes. I attempted to identify when the account was added, but without success — the user account had already been deleted by the time the issue was reported. There were no OST files or relevant traces in the usual locations, only those related to the default mail account on the PC.

I turned to the Windows Event Log for insights but quickly realized how messy it can get. From my research, two event IDs appear to be relevant for this kind of investigation:

• 5379 – Triggered when credentials are read from the Credential Manager
• 4624 – Logon event, where I focused on types 2 and 7 (since remote access is restricted)

Unfortunately, I wasn’t able to extract anything definitive. Background email polling seems to trigger events regardless of user interaction, cluttering the logs significantly.

That said, I did notice something interesting:

Event ID 5379 includes a Type property with values of 0 or 1. According to ChatGPT, this field might indicate whether the access was initiated automatically (background) or manually (user action). However, I haven’t found any official documentation to confirm this.

Gemini (Google) suggests that the Type field is not about the interaction type but rather acts as a response code (with 1 indicating an error). But even when Type = 1, the CountOfCredentialsReturned is still 1, and there's a separate ReturnCode property available — so this interpretation also seems inconsistent.

My question:

Any insights or references to official documentation would be greatly appreciated!

Best regards