RE: Security Logs
- From: Brian Delaney <bdelaney01@xxxxxxxxx>
- Date: Thu, 23 Mar 2006 13:49:02 -0800
One thing about security auditing is that it does not lie. If it says a set
of credentials was used at a specific time, it was.
So, if the user isn't doing it, they must have their password stored
somewhere.
Check for their password to be stored in: Services, Persistent Mapped
Network Drives, Credential Manager (control keymgr.dll) and 3rd party
applications on the source workstation
As for the user who does not work there anymore. Why is his account still
enabled? Disable it. That might also shed some light on what is causing
those audits, (ie saved credentials). One of your users may be unknowingly
using those credentials to access a resource because they are saved somewhere
on the system.
--
Brian Delaney, MCSE
"one3cap" wrote:
Couple of questions:.
i keep getting the same entry for one of my users in the security log:
Source: Security
Category: Account Logon
Event ID: 680
Type Success A
Computer: THE DC
Logon attempt by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Logon account: Michael.Jordan
Source Workstation: HDQORGL001
Error Code: 0x0
Just about every minute this event occurs.
2. (this is at 5am the user was not here and not logging on)
First event ID is the 576 @5:00am the event ID 540 same time and these 2
ID's repeat themselves 4 times ( so total of 8 events) then the last 2
events are the ID 538 i just dont know what these are i did some searches
couldnt really find anything........... i have seen these same exact
sequence of events through out the day even when the user is using the
computer and not logging off or anything any suggestions? maybe a good site
dealing with security logs. i have even seen these same events for a user
that is no longer with the company.
-event id 576
Special privileges assigned to new logon:
User Name: Bill.Gates
Domain: EBC
Logon ID: (0x0,0x277FBFAF)
Privileges: SeChangeNotifyPrivilege
-event id 540
Successful Network Logon:
User Name: x.x
Domain: EBC
Logon ID: (0x0,0x277FBF9E)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {57d3e28b-fe63-ecaa-4cfe-fa7f1f512a9e}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.0.98
Source Port: 2749
-event id 538
User Logoff:
User Name: Bill.Gates
Domain: EBC
Logon ID: (0x0,0x277FBF9E)
Logon Type: 3
- Prev by Date: why did these not change?
- Next by Date: RE: Upgrading from Win2000 domains to Win2003 domains: ROLL BACK !
- Previous by thread: why did these not change?
- Next by thread: Hiding Users in AD
- Index(es):
Relevant Pages
|
