What just happened?

From: Troy Murray (troymurray@hotmail.com)
Date: 08/31/02 

From: "Troy Murray" <troymurray@hotmail.com>
Date: Fri, 30 Aug 2002 23:27:27 -0400

OK, I was logged into my server using the Terminal Services when suddenly I
got kicked out. I tried to log back in but wasn't able to with my account
so I used the Administrator account. I then found this in the Event Log:

Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 630
Date: 8/30/2002
Time: 10:03:40 PM
User: NT AUTHORITY\SYSTEM
Computer: TE-ADMIN
Description:
User Account Deleted:
  Target Account Name: tmurray
  Target Domain: TE-ADMIN
  Target Account ID: S-1-5-21-682003330-1957994488-1202660629-1004
  Caller User Name: TE-ADMIN$
  Caller Domain: ED_DOMAIN
  Caller Logon ID: (0x0,0x3E7)
  Privileges: -

Did the computer delete me or is someone else using the computer account to
do this?

Relevant Pages

  • Re: the police was dispatched to ... the wrong house
    ... and ptocessing Caller ID. ... of alarm systems from your garage... ... because of a Caller ID - account number mismatch. ... alarm company to notify them of the change. ...
    (alt.security.alarms)
  • Re: Another security question/issue.
    ... The first event is missing the username and logon process appears 'munged'. ... Caller User Name: MYSERVER-SBS$ ... and, no I have not changed the administrator account password, but I ...
    (microsoft.public.windows.server.sbs)
  • Re: SMS_MP_CONTROL_MANAGER Issues
    ... Since installing SMS2003 service pack 2 I have been receiving the error ... Logon Failure: ... Caller User Name: - ... So after some more research it seems like the account SMS_SQL_RX_999 ...
    (microsoft.public.sms.admin)
  • Re: Excessive Security Success audits
    ... Event Category: Account Management ... Caller Domain: ROSEHILLCAPITAL ... Caller Logon ID: ... Target Server Name: localhost ...
    (microsoft.public.windows.server.sbs)
  • Re: question about burglar alarm dispute (San Francisco Bay Area)
    ... caller ID, so what's the alarm company to do? ... The central stations I know of will begin to bill you ... out the ass if your account goes into run away. ...
    (alt.security.alarms)