Does this indicate remote access to resources... Expand / Collapse
Author
Message
Posted 7/24/2019 3:37:47 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 7/24/2019 2:13:44 PM
Posts: 1, Visits: 0
Other than my own account name and SYSTEM, “THISGUY” is the only other one showing up in my event logs. We have hundreds of people on our network. How come THISGUY is the only one? He is an Admin but The Source network Address is his laptops IP, not a server...

An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: HEY\THISGUY
Account Name: THISGUY
Account Domain: HEY.NOATS.NET
Logon ID: 0x15BF9999
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {b09ae99f-90d9-9d85-edfd-592d0240abc3}

Process Information:
Process ID: 0x0
Process Name: -

Network Information:
Workstation Name: -
Source Network Address: 15.16.17.118
Source Port: 62989

Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

Post #8585
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 3:28am