Understaing Event Details in Windows NT

From: John Smith (for3nsics@yahoo.com.au)
Date: 01/13/03

  • Next message: Peter Snell: "RE: Understaing Event Details in Windows NT" 
    Date: Mon, 13 Jan 2003 16:11:20 +1100 (EST)
From: John Smith <for3nsics@yahoo.com.au>
To: focus-ms@securityfocus.com

    Hi all,

    I'm curious to know what the contents of the event
    details mean in MS event Viewer.

    i.e. How do you deterime from a successful Logon that
    the user only viewed event logs remotely and didn't
    mount a share ?

    Some other quesiton:
    What does "LoginID: (0x0,0xDFA0E5)" mean ?

    What does "Logon Type: 3" mean ?

    What does "Logon Process: KSecDD" mean ?

    Thanks in advance.

    http://greetings.yahoo.com.au - Yahoo! Greetings
    - Send your seasons greetings online this year!