UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 540 - Successful Network Logon / Logon Types for 540? / Latest Posts

RE: Logon Types for 540?

RandyFranklinSmith — Wed, 27 May 2009 12:31:35 GMT

Braino,

You are right. We knew about this but neglected to document. Logon Type 8 only shows up for 540 - not 528. The only time I've observed logon type 8 was the scenario you mentioned - IIS basic authentication - but I suppose it could show up with down-level SMB session authentication with old SAMBA clients but I can't say for sure.

Logon Types for 540?

Braino — Mon, 11 May 2009 19:24:41 GMT

Hey -

I noticed the description says this eventid (540) only happens for logon type 3. This isn't true as it also happens for Logon type 8 (NetworkClearText - most likely a Basic Authentication to IIS).

Is this right? Does EventID 528 ever show Logon type 8? Do any other logon types show on EventID 540?

Thanks,

Braino! ;)