Forum

Ultimate Windows Security Forum » Security Log » 552 - Logon attempt using explicit... » Info in 552 duplicated in 528?

Info in 552 duplicated in 528? Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
Braino
Posted 4/15/2010 7:37:11 PM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 2/11/2012 12:15:37 AM
Posts: 18, Visits: 8
Hi Randy,

  I'm analyzing this event right now - it appears to me that, especially if the target server name is "localhost", that anything else from this event already exists in a corresponding EventID 528.  For example,

EventID 552                                       EventID 528

Logged On User: Username      =         Caller User Name

Logged on User: Domain          =         Caller Domain

Target User Name                    =         User Name

Target Domain                         =         Domain

 

Thoughts?    

Post #357
RandyFranklinSmith
Posted 4/16/2010 9:32:41 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Could be.  Have you tried this with RunAs?  Would be interesting to compare the 2 events.
Post #360
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 12:41am