Does this indicate remote access to resources... Expand / Collapse
Author
Message
Posted 7/24/2019 3:37:47 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 7/24/2019 2:13:44 PM
Posts: 1, Visits: 0
Other than my own account name and SYSTEM, “THISGUY” is the only other one showing up in my event logs. We have hundreds of people on our network. How come THISGUY is the only one? He is an Admin but The Source network Address is his laptops IP, not a server...

An account was successfully logged on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Information:
Logon Type: 3
Restricted Admin Mode: -
Virtual Account: No
Elevated Token: Yes
Impersonation Level: Impersonation
New Logon:
Security ID: HEY\THISGUY
Account Name: THISGUY
Account Domain: HEY.NOATS.NET
Logon ID: 0x15BF9999
Linked Logon ID: 0x0
Network Account Name: -
Network Account Domain: -
Logon GUID: {b09ae99f-90d9-9d85-edfd-592d0240abc3}

Process Information:
Process ID: 0x0
Process Name: -

Network Information:
Workstation Name: -
Source Network Address: 15.16.17.118
Source Port: 62989

Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

Post #8585
Posted 9/9/2019 2:12:40 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
You'll have to take a look at the logs on the host at that time to get a better understanding. This user could have viewed a file share on your computer or any number of things.
Post #8591
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 6:17am