InstantForum.NET v4.1.4UltimateWindowsSecurity.com Forumhttp://forum.ultimatewindowssecurity.com/noreply@ultimatewindowssecurity.comTue, 07 Feb 2012 12:21:01 GMT20http://forum.ultimatewindowssecurity.com/Topic358-35-1.aspxDo you have a situation where you are getting a 552 on the client computer and a corresponding 528/540/4624 on the server? If so, can you post examples?Fri, 16 Apr 2010 09:36:48 GMTRandyFranklinSmithhttp://forum.ultimatewindowssecurity.com/Topic358-35-1.aspxI have seen this event where the target server is not LocalHost, but another server in another domain. </P><P>In analyzing, It appears if EventID 552 appears on one computer and the target was another computer, that I see a logon (528 or maybe 540 or 4624) on the Target Server's event log, with the target user name as the username of the 552 event, but the 528/540/4624 event does not seem to identify where the logon came from (i.e. the Name or IP address of the source computer, where the 552 eventid is logged), thus it's hard to correlate.</P><P>Has anyone else been looking these? it may show when explicit credentials are used but correlating appears difficult. </P><P>...But if target server is localhost, it looks like this event is redundant to 528.Thu, 15 Apr 2010 19:41:57 GMTBraino