Target Server not always Local Host Expand / Collapse
Author
Message
Posted 4/15/2010 7:41:57 PM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 2/11/2012 12:15:37 AM
Posts: 18, Visits: 8
I have seen this event where the target server is not LocalHost, but another server in another domain. 

In analyzing, It appears if EventID 552 appears on one computer and the target was another computer, that I see a logon (528 or maybe 540 or 4624) on the Target Server's event log, with the target user name as the username of the 552 event, but the 528/540/4624 event does not seem to identify where the logon came from (i.e. the Name or IP address of the source computer, where the 552 eventid is logged), thus it's hard to correlate.

Has anyone else been looking these?  it may show when explicit credentials are used but correlating appears difficult. 

...But if target server is localhost, it looks like this event is redundant to 528.

Post #358
Posted 4/16/2010 9:36:48 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Do you have a situation where you are getting a 552 on the client computer and a corresponding 528/540/4624 on the server?  If so, can you post examples?
Post #361
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:46pm