UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 528 - Successful Logon / What logon type for VPN access? / Latest Posts

RE: What logon type for VPN access?

jwalzer — Wed, 02 Sep 2009 10:27:17 GMT

Randy,

Thank you for the information

RE: What logon type for VPN access?

RandyFranklinSmith — Wed, 02 Sep 2009 05:32:19 GMT

Windows separates logon and authentication.

If Cisco VPN is using Kerberos to authenticate against AD you will see 672 - authentication ticket. If it is using NTLM you will see 680.

Whenever the Windows client applies group policy you will see a network logon (540 not 528) with logon type 3 in the description.

RE: What logon type for VPN access?

jwalzer — Tue, 01 Sep 2009 10:17:30 GMT

Sorry about the lack of info:

Was referring to the events that get logged on the domain controller when a user logs in remotely throuh the VPN client. The VPN server does integrate with AD so the user authenticates against AD

Thanks

RE: What logon type for VPN access?

RandyFranklinSmith — Tue, 01 Sep 2009 06:08:04 GMT

I would need a lot more information!

Are you referring to the what events are logged on the workstation or at the VPN server or domain controller?

Are we talking about an interactive logon to console of the workstation, or once logged on to the desktop, a VPN connection back to the corporate network?

Does the VPN server integrate with AD or use it's own credentials?

What logon type for VPN access?

jwalzer — Mon, 31 Aug 2009 11:22:49 GMT

Our users logon with the Cisco VPN client and I was wondering what logon type Microsoft considers this to be?

Thanks