The computer name PCxxxx$ in 540 User field Expand / Collapse
Author
Message
Posted 5/20/2010 4:57:26 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/20/2010 8:56:27 AM
Posts: 3, Visits: 6
Hi all,

I was checking log from my domain controllers and I saw 540 messages with a strange value in the user field.

user = PC1122$
computer = DC2
workstation name = PC3344

Why did I see the computer name in the user field instead of the log on user's name? And what does it mean?

I have W2003 domain controllers and XP clients (name starting with PCxxxx).

Thank you for your answer/explanation.
Post #381
Posted 5/25/2010 10:58:32 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
My first thought is that there is a service running on PC1122 as Network Service and that service is trying to access something on the other computer but your values don't really make sense.  Can you post an actual example please?
Post #384
Posted 2/2/2011 3:40:39 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 2/2/2011 3:32:17 PM
Posts: 1, Visits: 0
I've just started researching these events and came across this site/forum.

Here's my noob question:  Why does the servername have a "$" or what does "Servername$" indicate in the log?  Does it just refer to the server or does it indicate a method of connection, connection to a share, etc?

Thanks for any info.

WytLytnyn

Post #561
Posted 2/10/2011 9:58:18 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Internally in AD, computer names always end with a dollar sign.  As long as you already know you are looking at a computer account name like this case with that field in event ID 540, there is nothing significant about it.  Other places where you see account names, if there is a dollar sign on the end, that tells you the account is a computer account as opposed to a user account. 

Be aware that admins can create a user account with a $ on the end which obviously is not good practice but AD will allow it.

Post #580
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 5:00pm