Forum

Ultimate Windows Security Forum » Security Log » 540 - Successful Network Logon » Workstation blank when Auth. package is...

Workstation blank when Auth. package is... Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
Braino
Posted 11/19/2010 2:31:25 PM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 2/11/2012 12:15:37 AM
Posts: 15, Visits: 8
Hi Randy,

   On Eventid 540; I'm noticing the workstation name is blank (but the Source IP is still there) when the authentication package is Kerberos... Is this consistent in your experience? My guess is since the authenticaton package doesn't deal with workstation names, this field will be blank.  

   Just wanted a confirmation on your side...if you could 

Post #535
RandyFranklinSmith
Posted 11/19/2010 7:15:35 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326, Visits: 0
Yes, you are correct.  NTLM thinks in terms of workstation name but Kerberos doesn't
Post #536
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 9:27am