have face same problem
Do the Logon IDs found in data.win.system.message match for the 4624 and 4634 events? (Review Part 3 of the lab again).
