RE: Security Log Question

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Jerry zhao (v-jerryz_at_online.microsoft.com)
Date: 01/19/05 

Date: Wed, 19 Jan 2005 08:24:30 GMT

Hi Marcia,

Thanks for posting here!

>From the description, I understand that you want to know what the "$" sign
means beside the username in the security event logs.

The event log will record both system and user events. The username
followed by a "$" sign represents the name of the machine (computer). The
events are triggered by the system account instead of the user account.

Further more, Event ID 538 represents Interactive logoff.,For more
information, please refer to:

Distinguishing Windows NT Audit Event Records

http://support.microsoft.com/default.aspx?scid=kb;en-us;140714

http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/
en-us/Default.asp?url=/resources/documentation/Windows/2000/server/reskit/en
-us/w2000Msgs/5457.asp

 Hope the above information helps.

If you have any questions or concerns, please feel free to let me know.

Have a nice day!

Best regards,

Jerry Zhao (MSFT)

Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

Relevant Pages

  • Re: Security Log Question
    ... > means beside the username in the security event logs. ... > The event log will record both system and user events. ... > events are triggered by the system account instead of the user account. ... > Distinguishing Windows NT Audit Event Records ...
    (microsoft.public.windows.server.sbs)
  • Re: Stange access problem
    ... I didn't even think to look at the event logs. ... account, the internet, or any other server resource, even after logging ... it asks for his username and password. ... There are no strange problems installed on the client computer. ...
    (microsoft.public.backoffice.smallbiz)
  • Re: Simple Network Connection
    ... Posting on MS newsgroup will benefit all readers and you may get more help. ... Networking, Internet, Routing, VPN Troubleshooting on http://www.ChicagoTech.net ... However, I get an error message that says, "network path not found". ... bar and it then asks me for a username and password. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Token assert
    ... I ended up posting some code at my MSN blog ... Passing a SendHashed username token and have it verify in custom UTM. ... > or code with a manual enumeration of the tokens and checking roles. ... > William Stacey, MVP ...
    (microsoft.public.dotnet.framework.webservices.enhancements)
  • Re: Wheres Hallo ! Ich was "Foolish question"
    ... Presumably he found a German group more to his liking. ... He may have changed his username, been posting using X-NoArchive (I ... If you know the username that he used you might try Google Groups ... sale of a book can become a subject of inquiry, and of criminal inquiry ...
    (comp.os.linux.networking)