Cannot corelate Caller Logon ID which is in... Expand / Collapse
Author
Message
Posted 3/21/2011 10:44:41 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/21/2011 10:36:05 AM
Posts: 2, Visits: 0
I have multiple instances of a 529 type 3 happening in Win 2003 svr. I cannot leverage the little information that is availible in the event properties.

Caller Logon ID: (0x0,0x3E7)

Is there a ref somewhere that matches up this hex to process or user account?

Thanks for and advice you may have.

-C

Post #620
Posted 3/21/2011 10:45:32 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 3/21/2011 10:36:05 AM
Posts: 2, Visits: 0
My bad Its a 531 type 3 event not a 529.

Sorry

Post #621
Posted 3/22/2011 7:50:02 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Logon ID doesn't really have much if any meaning in this event because you are not logged on yet - since it failed. 

These are the only fields that are really useful:

  • User Name:
  • Domain:
  • Logon Type:
  • Logon Process: (limited value)
  • Authentication Package: (limited value)
  • Workstation Name:
  • and

    Source Network Address

    Post #623
    « Prev Topic | Next Topic »


    Permissions Expand / Collapse

    All times are GMT -5:00, Time now is 8:16am