Re: Ip Address in event viewer

From: Karl Levinson [x y] mvp (levinson_k@despammed.com)
Date: 03/05/03 

From: "Karl Levinson [x y] mvp" <levinson_k@despammed.com>
Date: Wed, 5 Mar 2003 11:04:55 -0500

Answered in the FAQ:

http://securityadmin.info/faq.htm

Not possible without third party tools, such as NTSYSLOG and a firewall and
a syslog client like www.kiwisyslog.com .. or you could make sure the time
on your firewall matches your computer time and then just manually try to
correlate the logs.

Note that people on the internet should really not have the ability to
attempt logons to your computer. Netbios should be blocked at your
firewall. Computer names that appear in your logs that are from your
internal network should usually be resolvable to an IP address and/or
tracable through other means.

"Dario" <brignone@unitec.it> wrote in message
news:01c801c2e304$f6078ee0$3301280a@phx.gbl...
> How can I configure event viewer to display IP Address
> when an event ID 529 occours (logon failure)?
>
> The default configuration only display the Domain name,
> like the following example:
>
> Logon Failure:
> Reason: Unknown user name or bad password
> User Name: username
> Domain: MESCALIN
> Logon Type: 3
> Logon Process: NtLmSsp
> Authentication Package: NTLM
> Workstation Name: MESCALIN
>
>
> Thanks
>
> Dario 

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.459 / Virus Database: 258 - Release Date: 2/25/2003

Relevant Pages

  • Re: ISA SERVER NOT STARTING
    ... I delete the nat/basic firewall and stop and started the RRAS an tried to ... There were no critical events in the DNS Server Log in the last 24 hours. ... An error occurred during logon ... Caller User Name: - ...
    (microsoft.public.windows.server.sbs)
  • Re: Hidden User Account Created By Disgruntled Room mate.
    ... Be sure you firewall is enabled, if unsure how, go to Help and Support ... i just did that, and tweakui at logon gives me three> options: parse autoexec.bat at logon > show administrator ... >>>>From there you can go to User Accounts in Control ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Network Services/NT Authority
    ... gpedit.msc to access and edit local Group Policy in XP Pro. ... just looking at the firewall settings and not Group Policy firewall ... accounts on your computer via the network which can occur if you are ... for local keyboard interactive logon. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Attempt Attack
    ... the service they are trying to logon to that match the time of the logon ... Of course for this to work well the times of the firewall and the ... proxy has some logging capability as it may be your firewall. ... I have been noticing computers from domains ...
    (microsoft.public.win2000.security)
  • Re: WebDAV problem with digest authentication behind firewall
    ... is the one from inside the firewall. ... attempt to make a connection to server 192.168.40.19. ... connection and they both got a logon box. ... >> Bernard Cheah ...
    (microsoft.public.inetserver.iis)
Quantcast