[THIN] Re: Security Event Logs
- From: "Tim Mangan" <tmangan@xxxxxxxxxxxx>
- To: <thin@xxxxxxxxxxxxx>
- Date: Wed, 2 Feb 2005 13:54:52 -0500
One reason would be if you reconnected to an existing session. A new
session is created until you log-in. After accepting your credentials this
new session is killed and you are connected to your old session - thus you
see a login followed by a logout associated with the temporary session.
Tim Mangan
_____
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx] On Behalf
Of Stratton, Doug MSER:EX
Sent: Wednesday, February 02, 2005 12:36 PM
To: 'thin@xxxxxxxxxxxxx'
Subject: [THIN] Security Event Logs
Can anyone tell me why I would get these two security event log id everytime
I log onto a ts with w2k on it?
I looked up the events at event id web and it says 528 is a logon (this is
good) and 538 is a log off (bad) I am not logging off just on.
First
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 528
Date: 2005-02-02
Time: 8:45:15 AM
User: domain\dstr
Computer: servername
Description:
Successful Logon:
User Name: dstr
Domain: domain
Logon ID: (0x0,0x18A37A52)
Logon Type: 7
Logon Process: User32
Authentication Package: Negotiate
Workstation Name: server
Then
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 2005-02-02
Time: 8:45:15 AM
User: domain\dstr
Computer: server
Description:
User Logoff:
User Name: dstr
Domain: domain
Logon ID: (0x0,0x18A37A52)
Logon Type: 7
Thanks
Doug Stratton
Telephone: (250) 356-6678
Email: Doug.M.Stratton@xxxxxxxxxxxxxxx
Other related posts:
