[THIN] Security Event Logs
- From: "Stratton, Doug MSER:EX" <Doug.M.Stratton@xxxxxxxxxxxxxxx>
- To: "'thin@xxxxxxxxxxxxx'" <thin@xxxxxxxxxxxxx>
- Date: Wed, 2 Feb 2005 09:35:30 -0800
Can anyone tell me why I would get these two security event log id everytime
I log onto a ts with w2k on it?
I looked up the events at event id web and it says 528 is a logon (this is
good) and 538 is a log off (bad) I am not logging off just on.
First
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 2005-02-02
Time: 8:45:15 AM
User: domain\dstr
Computer: servername
Description:
Successful Logon:
User Name: dstr
Domain: domain
Logon ID: (0x0,0x18A37A52)
Logon Type: 7
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: server
Then
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 2005-02-02
Time: 8:45:15 AM
User: domain\dstr
Computer: server
Description:
User Logoff:
User Name: dstr
Domain: domain
Logon ID: (0x0,0x18A37A52)
Logon Type: 7
Thanks
Doug Stratton
Telephone: (250) 356-6678
Email: Doug.M.Stratton@xxxxxxxxxxxxxxx
Other related posts:
