UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 552 - Logon attempt using explicit credentials / Info in 552 duplicated in 528? / Latest PostsInstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comTue, 07 Feb 2012 12:19:06 GMT20RE: Info in 552 duplicated in 528?http://forum.ultimatewindowssecurity.com/Topic357-35-1.aspxCould be. Have you tried this with RunAs? Would be interesting to compare the 2 events.Fri, 16 Apr 2010 09:32:41 GMTRandyFranklinSmithInfo in 552 duplicated in 528?http://forum.ultimatewindowssecurity.com/Topic357-35-1.aspxHi Randy,<P> I'm analyzing this event right now - it appears to me that, especially if the target server name is "localhost", that anything else from this event already exists in a corresponding EventID 528. For example, </P><P>EventID 552 EventID 528</P><P>Logged On User: Username = Caller User Name</P><P>Logged on User: Domain = Caller Domain</P><P>Target User Name = User Name</P><P>Target Domain = Domain<P> <P>Thoughts? Thu, 15 Apr 2010 19:37:11 GMTBraino