|
|
|
Forum Newbie
Group: Forum Members
Last Login: 7/24/2019 2:13:44 PM
Posts: 1,
Visits: 0
|
|
Other than my own account name and SYSTEM, “THISGUY” is the only other one showing up in my event logs. We have hundreds of people on our network. How come THISGUY is the only one? He is an Admin but The Source network Address is his laptops IP, not a server...
An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: HEY\THISGUY
Account Name: THISGUY
Account Domain: HEY.NOATS.NET
Logon ID: 0x15BF9999
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {b09ae99f-90d9-9d85-edfd-592d0240abc3}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name: -
Source Network Address: 15.16.17.118
Source Port: 62989
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
|
|
|
|
|
Supreme Being
Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237,
Visits: 0
|
|
| You'll have to take a look at the logs on the host at that time to get a better understanding. This user could have viewed a file share on your computer or any number of things.
|
|
|
|