Re: Advapi Events - Log on/off - Should I be suspicious of these??

From: w. jORDAN (wmjordan@163.com)
Date: 02/21/03 

From: "w. jORDAN" <wmjordan@163.com>
Date: Fri, 21 Feb 2003 09:40:46 +0800

Emdee,

Logon Type = 4?

It seems to me that type=4 means it logs on as a batch job? or a service?.

On a machine running ASPnet, ASPNET account runs as a batch job and a
service,
it will automatically log onto the machine.
If the account is not ASPNet, you should pay great notice to it, check its
rights, and the group it belongs to, and delete it from your user list when
appropriate.

And as far as I know,
Logon Type=7 means a local logon, and type=3 means a network logon.
Is these true?
Anybody can assure me?

Regards,
Jordan

"Emdee" <mikeDONTSPAM@webheat.co.uk>
wrote:3e55173f$0$14793$afc38c87@news.easynet.co.uk...
> -------------------------------------------------------------------------- 

--
> --
> Event Type: Success Audit
> Event Source: Security
> Event Category: Logon/Logoff
> Event ID: 528
> Date:  20/02/2003
> Time:  17:24:00
> User:  *ServerName*\*UserName*
> Computer: *ServerName*
> Description:
> Successful Logon:
>   User Name: *UserName*
>   Domain:  APP3
>   Logon ID:  (0x0,0xE5F358A)
>   Logon Type: 4
>   Logon Process: Advapi
>   Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
>   Workstation Name: *ServerName*
> --------------------------------------------------------------------------
--
> --
>
>