UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 528 - Successful Logon

event 528 -source network address 127.0.0.1

sbenjamin — Thu, 19 Jan 2012 13:37:48 GMT

I'm seeing successful logins for a local admin account on a 2003 server where it's shown as event 528, type 10, source network address 127.0.0.1. There doesn't appear to be an ilo card and the only interfaces are loopback and an ethernet card. Any ideas why a remote login would appear to come from the local host? =/

Event 528 Missing Source IP

PaulL — Tue, 27 Sep 2011 20:06:34 GMT

What would cause the source address to be missing in 528 events from Windows 2003 servers? I see this constantly and it greatly diminishes the value of these logs.

Best Regards,
Paul

What logon type for VPN access?

jwalzer — Mon, 31 Aug 2009 11:22:49 GMT

Our users logon with the Cisco VPN client and I was wondering what logon type Microsoft considers this to be?

Thanks

528 and audit settings

jwspain — Mon, 22 Jun 2009 09:10:09 GMT

What audit settings on the DC control whether 528 records are recorded?

Our system is flooded with 540 events, but the only 528 events seem to be when an ADMIN logs on to the DC directly.

We want to trap workstation logon events only.

Are the audit settings that will accomplish this as well as retaining the other AD events recommended on your website?

Thanks,

John