Re: Overnight Logons

The ones with the $ are all computer names, right? Those should be system events rather than user events.

Is Dwayne leaving his desktop PC running overnight? Logon Type 3 is a logon from a different machine in the local network. See http://www.windowsecurity.com/articles/Logon-Types.html.



"Rod" <Rod@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:055DBA68-4AAA-4DFA-BDF3-93CB7B2C032E@xxxxxxxxxxxxxxxx
here are 2 of the dwaynes and one susan$
what are the ones with $ after them?


Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 11/4/2008
Time: 11:01:12 PM
User: WELL\Dwayne
Computer: WATER
Description:
User Logoff:
User Name: Dwayne
Domain: WELL
Logon ID: (0x0,0xCAD7263)
Logon Type: 3


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 11/4/2008
Time: 11:01:01 PM
User: WELL\Dwayne
Computer: WATER
Description:
User Logoff:
User Name: Dwayne
Domain: WELL
Logon ID: (0x0,0xCAD7222)
Logon Type: 3


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 11/4/2008
Time: 11:01:20 PM
User: WELL\SUSAN589$
Computer: WATER
Description:
Successful Network Logon:
User Name: SUSAN589$
Domain: WELL
Logon ID: (0x0,0xCAE0917)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {ec4e8a6f-085c-1d79-eb9d-d86827b8b6f6}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.16.109
Source Port: 2774


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.



"Larry Struckmeyer [SBS-MVP]" wrote:

Without any other information, user dwayne with simple password could mean
your server has been compromised. All users should have pass phrases, not
pass words. Pass phrases are easier to remember, hard, if not impossible to
hack.

"My Te@M" 21 "Y0ur Team 12"! is a good example. Substitute your favorite
teams.

The info requested earlier would help diagnose your situation.

-Larry


"Rod" <Rod@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:7CCF321D-4A9B-482F-95DA-9230EF51B44E@xxxxxxxxxxxxxxxx
> Its a user that is not in the office but he does exist. He does not use
> RWW
> (i'll disable that for him). and his name is dwayne. He probably has a
> simple
> password. I'll fix that also.
>
> "Larry Struckmeyer [SBS-MVP]" wrote:
>
>> Hi Rod:
>>
>> From the event, can you post the details... login type and the rest.
>> When
>> you say there is a "user who is not here" do you mean he is out of the
>> office, or that he doesn't exist? If this user exists, and his >> computer
>> is
>> shut down, could it be RWW? If neither of those, is this a common >> name
>> and
>> a simple password?
>>
>> When you say inaccessible, what are the exact symptoms? Inaccessible
>> from
>> the LAN and or RWW? What are the exact symptoms, messages that occur
>> when
>> this happens.
>>
>> -Larry
>>
>> "Rod" <Rod@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>> news:75589417-F14D-4157-B5E4-948F22048BD9@xxxxxxxxxxxxxxxx
>> > Recently our server has been suddenly inaccessable, when i reboot >> > the
>> > server
>> > it's fine. While trying to identify the issue in the even viewer I
>> > notice
>> > success audits from usernames with $ after them. Are they normal in >> > the
>> > middle of the night?
>> >
>> > also I notice a particular user logging on that I know is not here >> > (no
>> > $
>> > sign after that account)
>>
>>



.

Relevant Pages

  • Re: Overnight Logons
    ... Logon Type 3 is a logon from a different machine in the local network. ... Event Type: Success Audit ... Event Source: Security ...
    (microsoft.public.windows.server.sbs)
  • Re: Overnight Logons
    ... Is Dwayne leaving his desktop PC running overnight? ... Logon Type 3 is a logon ... Event Source: Security ...
    (microsoft.public.windows.server.sbs)
  • Re: 30k plus Event 537s a Day
    ... > Event Source: Security ... > Logon Failure: ... > Logon Type: 3 ... > Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: KDC Event ID 7 and Wins startup errors.
    ... Event Type: Information ... Event Source: USER32 ... Logon Failure: ... Caller User Name: $ ...
    (microsoft.public.windows.server.sbs)
  • Re: KDC Event ID 7 and Wins startup errors.
    ... I was wondering if the reboot might have been in conjunction with patch installs - seems like sometimes installing a lot of updates or whatever can add a little more activity to the next restart, and that something like that might have caused the errors you saw. ... > Event Type: Information ... > Event Source: USER32 ... > Logon Failure: ...
    (microsoft.public.windows.server.sbs)
Loading