Security

Ask something
Discussion Locked

Auditing logons

0 helpful
2 replies

by fiscom3

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Can anyone decipher this? I found this in the security log after returning from a day off.

Event Type: Failure audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 537
Date: 3/14/2003
Time: 1:07:41 PM
User: NT AUTHORITY SYSTEM
Computer: Bruce
Description:
Logon Failure:
Reason: An unexpected error occurred during logon
User name: SWIPE
Domain: cccccweb
Logon type: 3
Logon Process: NtLmSsp
Authentification Package: \NTLM
Workstation Name: \\DATACARD2

2 replies

by timwalsh

The user SWIPE attempted to logon to the domain cccccweb from workstation DATACARD2 and failed for an unknown reason ("unexpected error"). The unexpected error could have been for any of several reasons, mostly likely some component of the logon process failing to execute properly.

This is not the same as a failed logon due to "unknown user or password," which would have been stated if it were the case. As long as you don't start seeing a series of the same error in your logs, it can be passed off as a momentary glitch in the process. Most likely, if you are also auditing successful logons, you will see that this user was able to successfully logon shortly after this error occured.

by fiscom3

this log was greated on a machine that was not named swipe or datacard. Could someone from either one of these machines have tried to logon my machine? There were 58 attempts and/or accesses that day

This discussion is closed to new replies.