Re: Failure audit in security log

From: Eric Fitzgerald [MS] (ericf@online.microsoft.com)
Date: 10/31/02 

From: "Eric Fitzgerald [MS]" <ericf@online.microsoft.com>
Date: Thu, 31 Oct 2002 12:14:50 -0800

One more note: to actually see the remote machine's IP address, you have to
issue the command:
nbtstat -c
after the nbtstat -a command.

Eric

"Eric Fitzgerald [MS]" <ericf@online.microsoft.com> wrote in message
news:3dc18ef2$1@news.microsoft.com...
> If the workstation is on the same subnet as you, or if it points to your
> WINS environment, then the following command will return the machine's IP
> address:
>
> nbtstat -a workstationname
>
> If the machine is not resolvable by WINS or broadcast, then no, you can't
> get any more information about it after the fact.
>
> Eric
>
>
> "AiKay" <iwazeer2@hotmail.com> wrote in message
> news:#F#gxFPgCHA.2256@tkmsftngp12...
> > I saw some Failure audits in my security log with Event Code Ids 529 and
> > 681. The log (in event viewer) only shows a workstation name in the
> > Workgroup domain. Is there anyway I can find out more information about
> that
> > workstation or try to gather more information that will be useful for my
> > network security person?
> >
> > Aikay
> >
> >
>
>

Relevant Pages

  • Re: Failure audit in security log
    ... I already tried nbtstat and also checked my arp ... Imran ... > after the nbtstat -a command. ... >> If the workstation is on the same subnet as you, or if it points to your ...
    (microsoft.public.win2000.security)
  • Re: Failure audit in security log
    ... If the workstation is on the same subnet as you, or if it points to your ... then the following command will return the machine's IP ... > I saw some Failure audits in my security log with Event Code Ids 529 and ...
    (microsoft.public.win2000.security)
  • Re: Question Multi A/V Tool
    ... You have to execute NET START WORKSTATION in a Command Prompt. ... and in the Command Prompt window enter; ...
    (microsoft.public.security.virus)
  • Re: WINS resolution
    ... I run the command nbtstat -N -S -c and following is the output that I ... Microsoft MVP - Directory Services ... Instead of the website you're using, try using OEx (Outlook Express ...
    (microsoft.public.windows.server.networking)
  • Re: 2 workstation names
    ... SET command on a command prompt. ... When you logon to a domain it provide the following environment variables: ... LOGONSERVER - The authenticating domain controller ComputerName, ... For some reason I seem to have 2 workstation names on my W2K ...
    (microsoft.public.win2000.networking)