672s in the middle of the night Expand / Collapse
Author
Message
Posted 10/29/2009 3:44:13 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/12/2011 7:13:51 AM
Posts: 4, Visits: 16
Hi

After watching some of your webinars and reading on your site I has understood that 672s are logged when user logs on to his workstation. After some investigation on my own I has realized that 672s are also logged when the user unlocks his workstation, am I right? But what about 672s in the middle of the night when the user is at home sleeping, how come a 672 are being logged at that time?

What i am looking for is a way to find out when the user logs on to, or unlook his computer, maby 672s aren´t the right thing to look for?

Post #250
Posted 10/29/2009 7:47:30 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
If a user remains logged on to his workstation, certain automated processes on the workstation such as group policy refresh, scheduled tasks or system services configured to run as his account may result in 672s logged on the domain controller.  Or the user may connect to your VPN or access a IIS website like SharePoint that uses Windows authentication. 

A 672 just means that a user was authenticated - not how or for what purpose.

Post #251
Posted 6/14/2011 10:02:44 AM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 2/11/2012 12:15:37 AM
Posts: 18, Visits: 8
Hi Randy,

  I think Authentication tickets are only good for 10 hours, so would it make sense that the workstation re-authenticated the user because the original TGT expired? 

Post #730
Posted 6/16/2011 11:28:04 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
could be but you will see a ticket renewal events first
Post #731
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 10:47pm