Info required on windows security event [... Expand / Collapse
Author
Message
Posted 5/14/2010 9:12:36 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/17/2010 3:25:15 PM
Posts: 1, Visits: 9
I have few doubts which i'm not able to understand while analyzing the Windows 2003 logon failure logs.

I have seen the below two cases in many of the logs

case 1)sourceusername:SYSTEM
destinationusername:vicky

case 2)sourceusername:vicky
destinationusername:SYSTEM

At what times the sourceusername would appear as a SYSTEM?
At what times destinationusername would appear as a SYSTEM?
Post #378
Posted 5/17/2010 10:42:50 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
this is the wrong event ID to post this subject.  Please re-post under the event ID where you are getting these events and post entire examples of the events please.  if you need to replace sensistive information, that's understood
Post #379
Posted 5/1/2014 5:39:43 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/27/2014 9:17:18 AM
Posts: 1, Visits: 0
I needed your assitance in getting an automation via powershell script for the below scenario:
"A user logs in to the system and modifies scheduled task or job. We should receive an alert which would compare old and new tasklist and should have modified content listed."


Its similar to Cronjobs in unix, where we shall be able to track changes done in for any cronjoob. Kindly assist
Post #1340
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 12:35pm