UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 514 - An authentication package has been loaded by the Local Security Authority / Info required on windows security event [ ref:00D799ma.5007CCNuV:ref ] / Latest PostsInstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comTue, 07 Feb 2012 12:15:13 GMT20RE: Info required on windows security event [ ref:00D799ma.5007CCNuV:ref ]http://forum.ultimatewindowssecurity.com/Topic378-15-1.aspxthis is the wrong event ID to post this subject. Please re-post under the event ID where you are getting these events and post entire examples of the events please. if you need to replace sensistive information, that's understoodMon, 17 May 2010 10:42:50 GMTRandyFranklinSmithInfo required on windows security event [ ref:00D799ma.5007CCNuV:ref ]http://forum.ultimatewindowssecurity.com/Topic378-15-1.aspxI have few doubts which i'm not able to understand while analyzing the Windows 2003 logon failure logs.<br> <br>I have seen the below two cases in many of the logs <br> <br>case 1)sourceusername:SYSTEM<br> destinationusername:vicky<br> <br>case 2)sourceusername:vicky<br> destinationusername:SYSTEM<br> <br>At what times the sourceusername would appear as a SYSTEM?<br>At what times destinationusername would appear as a SYSTEM?<br>Fri, 14 May 2010 21:12:36 GMThry_ms