Event ID 528 and 538

From: Kevin (kevinhendrix_at_yahoo.com)
Date: 09/04/03 

Date: Wed, 3 Sep 2003 23:31:20 -0400

I am showing access (logon and logoff) on a workstation at
a time when I was not present. Is there a flaw in NT 40 or
is it a trojan or software package doing that? I am at a
loss. I am in the domain admins group. Please enlighten
me. Thanks in advance for any info...
Kevin

Relevant Pages

  • Re: Security log events 528 and 538
    ... > I am showing access (logon and logoff) on a workstation at ...
    (microsoft.public.security)
  • Security log events 528 and 538
    ... I am showing access (logon and logoff) on a workstation at ...
    (microsoft.public.security)
  • Re: Roaming Profiles - Deleted Files & Folders Reappear
    ... Whether this be through terminal services or another interactive logon. ... to a TS session, change their profile in TS logoff, and then logoff the ... The fact that they'd not made any changes to the workstation ...
    (microsoft.public.windows.server.active_directory)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)
  • Re: Daily Server Report (Critical Errors, Event ID: 537)
    ... Also, Logon type of 3 is a network logon, this is considered a ... Does this issue happen on client workstation or server? ... Does your server and all clients' workstation work well now? ... issue in your Network? ...
    (microsoft.public.windows.server.sbs)