Forum

Ultimate Windows Security Forum » Security Log » 540 - Successful Network Logon » Logon Types for 540?

Logon Types for 540? Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
Braino
Posted 5/11/2009 7:24:41 PM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 10/23/2009 12:24:03 PM
Posts: 6, Visits: 1
Hey -

I noticed the description says this eventid (540) only happens for logon type 3.  This isn't true as it also happens for Logon type 8 (NetworkClearText - most likely a Basic Authentication to IIS). 

Is this right? Does EventID 528 ever show Logon type 8? Do any other logon types show on EventID 540?

Thanks,

Braino!

Post #89
RandyFranklinSmith
Posted 5/27/2009 12:31:35 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 171, Visits: 0
Braino,

You are right.  We knew about this but neglected to document.  Logon Type 8 only shows up for 540 - not 528.  The only time I've observed logon type 8 was the scenario you mentioned - IIS basic authentication - but I suppose it could show up with down-level SMB session authentication with old SAMBA clients but I can't say for sure.

Post #97
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 4:28pm