InstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comThu, 17 May 2012 08:48:40 GMT20http://forum.ultimatewindowssecurity.com/Topic895-22-1.aspxSince the authentication is done locally the terminal services logon gives the local IP address. The IP address is inconsistant and is not always listed. We do not recommend using the local administrator account for a terminal services logon. A domain account would allow better monitoring.Mon, 20 Feb 2012 16:01:34 GMTwhsmithhttp://forum.ultimatewindowssecurity.com/Topic895-22-1.aspxI'm seeing successful logins for a local admin account on a 2003 server where it's shown as event 528, type 10, source network address 127.0.0.1. There doesn't appear to be an ilo card and the only interfaces are loopback and an ethernet card. Any ideas why a remote login would appear to come from the local host? =/Thu, 19 Jan 2012 13:37:48 GMTsbenjamin