–A–

–B–

–C–

–D–

–E–

–F–

–G–

–H–

–I–

–J–

–K–

–L–

–M–

–N–

NTLM V1

many of these are bogus/not important because the Account Name field of event 4624 records is ANONYMOUS LOGON. We’re only interested in domain users, so specify your domain. This seems to be the easiest way to screen out ANONYMOUS LOGON

list Events ID 4624 records meeting criteria

EventCode=4624 "Package Name (NTLM only): NTLM V1" Account_Domain="yourdomain"

download accounts with count for each to export

EventCode=4624 "Package Name (NTLM only): NTLM V1" Account_Domain="yourdomain" | stats count by Account_Name

–O–

–P–

–Q–

–R–

–S–

–T–

–U–

–V–

–W–

–X–

–Y–

–Z–