|
|
|
Forum Newbie
Group: Forum Members
Last Login: 5/20/2010 8:56:27 AM
Posts: 3,
Visits: 6
|
|
Hi all,
I was checking log from my domain controllers and I saw 540 messages with a strange value in the user field.
user = PC1122$
computer = DC2
workstation name = PC3344
Why did I see the computer name in the user field instead of the log on user's name? And what does it mean?
I have W2003 domain controllers and XP clients (name starting with PCxxxx).
Thank you for your answer/explanation.
|
|
|
|
|
Expert
Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326,
Visits: 0
|
|
| My first thought is that there is a service running on PC1122 as Network Service and that service is trying to access something on the other computer but your values don't really make sense. Can you post an actual example please?
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 2/2/2011 3:32:17 PM
Posts: 1,
Visits: 0
|
|
| I've just started researching these events and came across this site/forum. Here's my noob question: Why does the servername have a "$" or what does "Servername$" indicate in the log? Does it just refer to the server or does it indicate a method of connection, connection to a share, etc? Thanks for any info. WytLytnyn
|
|
|
|
|
Expert
Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326,
Visits: 0
|
|
| Internally in AD, computer names always end with a dollar sign. As long as you already know you are looking at a computer account name like this case with that field in event ID 540, there is nothing significant about it. Other places where you see account names, if there is a dollar sign on the end, that tells you the account is a computer account as opposed to a user account. Be aware that admins can create a user account with a $ on the end which obviously is not good practice but AD will allow it.
|
|
|
|