|
|
|
Forum Newbie
Group: Forum Members
Last Login: 1/19/2012 12:13:53 PM
Posts: 1,
Visits: 0
|
|
| I'm seeing successful logins for a local admin account on a 2003 server where it's shown as event 528, type 10, source network address 127.0.0.1. There doesn't appear to be an ilo card and the only interfaces are loopback and an ethernet card. Any ideas why a remote login would appear to come from the local host? =/
|
|
|
|
|
Security Log Nerd
Group: Administrators
Last Login: 4/16/2009 1:11:51 PM
Posts: 22,
Visits: 0
|
|
| Since the authentication is done locally the terminal services logon gives the local IP address. The IP address is inconsistant and is not always listed. We do not recommend using the local administrator account for a terminal services logon. A domain account would allow better monitoring.
|
|
|
|