Logon Types for 540? Expand / Collapse
Author
Message
Posted 5/11/2009 7:24:41 PM
Expert from Quest Software

Expert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest SoftwareExpert from Quest Software

Group: Forum Members
Last Login: 2/11/2012 12:15:37 AM
Posts: 18, Visits: 8
Hey -

I noticed the description says this eventid (540) only happens for logon type 3.  This isn't true as it also happens for Logon type 8 (NetworkClearText - most likely a Basic Authentication to IIS). 

Is this right? Does EventID 528 ever show Logon type 8? Do any other logon types show on EventID 540?

Thanks,

Braino!

Post #89
Posted 5/27/2009 12:31:35 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Braino,

You are right.  We knew about this but neglected to document.  Logon Type 8 only shows up for 540 - not 528.  The only time I've observed logon type 8 was the scenario you mentioned - IIS basic authentication - but I suppose it could show up with down-level SMB session authentication with old SAMBA clients but I can't say for sure.

Post #97
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 5:55pm