How to link 540 events to 673/672 events Expand / Collapse
Author
Message
Posted 1/21/2014 3:51:24 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/21/2014 3:43:13 PM
Posts: 1, Visits: 0
Hi,

I am trying to link Account logon events (672,673) etc events on my DC to associated logon events (540, etc) on the same server. I have tried to link them by looking for the same Logon_GUID and Logon_ID fields but they do not correlate. I have checked every single possible pair of 672/673 and 540 events in our log and none share the same Logon_GUID or Logon_ID.

Can someone tell me how I'm going wrong?

Thanks,

RU
Post #1311
Posted 2/2/2014 2:05:46 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 234, Visits: 0
I don't believe that these events will necessarily link. 540 is a logon event while 672 and 673 is an authentication event. The Logon Guid in 540 is not documented so I wouldn't assume that it will correlate to any other events. Event ID 540 will be logged whether the account is a local SAM account or Domain Account. Events 672 and 673 are kerberos related so you won't be able to assume that these events can be correlated.
Post #1316
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 8:10am