obscure logon events?
- From: "John Alborn" <roberta3002@xxxxxxxxx>
- Date: Wed, 3 Aug 2005 21:50:13 +0300
Hello,
SBS2003 Premium.
While trying to figure out if one user has been loggen in remotely (through
remote desktop)
I noticed that security event log has entries for this user almost every 3-
4 hours ...
According to logon type : Logon Type: 3
it looks like from network. In fact IP is of the same PC where SBS 2003
runs.
What's the meaning of such an entry?
Is it normal?
How can I check easily if some user has been using remote connection?
Tia
John
Event log entry:
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 03.08.2005
Time: 02:42:54
User: RIO\romsete
Computer: Rogxxxx-8U9TE9M
Description: Successful Network Logon:
User Name: romsete
Domain: RIO
Logon ID: (0x0,0x86E390)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {1cbe0079-3403-87b2-af21-38b3290198d9}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.21.161
Source Port: 0
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
.
- Follow-Ups:
- RE: obscure logon events?
- From: "Brandy Nee [MSFT]"
- RE: obscure logon events?
- Prev by Date: SBS2003 and stand alone ISA2004
- Next by Date: Re: Port 443... SSL
- Previous by thread: SBS2003 and stand alone ISA2004
- Next by thread: RE: obscure logon events?
- Index(es):
Relevant Pages
|
