logon to the LaN Expand / Collapse
Posted 10/31/2011 2:15:28 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 8/25/2009 12:25:58 PM
Posts: 1, Visits: 0
I was going to use a successful 680 event to identify a user Signing on to the LAN successfuly and from what taskstation.  But when I got some results that showed the same user but the time stamps were sec's appart, I was doubting what I was uisng.

with some more digging I found users using a combination of 672/673, so I'm getting confused.  If a 680 failure event is what I'm using to say why a user did not get signed on, why wouldn't I use the successful to validate them getting on the LAN?

I'm using 2003 and some 2008 DC's what should I be doing?


Post #827
Posted 11/14/2011 8:56:17 AM


Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
I know it looks like you are logging on to the network or domain but there is no such thing.  When you logon with a domain account you are logging into your workstation.  then as you access other member servers your are logging into each of them.  The domain controller is authenticating you each time but does not keep track of where or how long you are logged in.  Each computer you access is responsible for its own logon sessions.

680 is an NTLM event.  672 is Kerberos.  Windows can use either of these.

Post #850
« Prev Topic | Next Topic »

Permissions Expand / Collapse

All times are GMT -5:00, Time now is 2:46am