I would be glad if you can assist me in this strange issue. I have been getting following event on one of the server which as Win2003 with SP2. Even the engineer dint logged in to that server then how and why this following event is generated regularly ? I tried to run Process explore, Process monitor from Sysinternals but I dint found any relevant information, even checked services run-as , checked IIS and other possibilitys. But no result I found this URL only http://blogs.msdn.com/b/ericfitz/archive/2004/12/09/279282.aspx Your assistance please J Successful Network Logon: User Name: testuser Domain: Xyz Logon ID: (0x0,0x62AFC0) Logon Type: 3 Logon Process: Authz Authentication Package: Kerberos Workstation Name: Server name Logon GUID: - Caller User Name: Server name Caller Domain: Xyz Caller Logon ID: (0x0,0x3E7) Caller Process ID: 872 Transited Services: - Source Network Address: - Source Port: - Regards, M.S Thanks

Are you sure that there is no application / service that is running using this account? You should check that. This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration

Thanks for you reply. Well indeed i have seen all the possibilities and i dint found any service nor application used by that account Kindly waiting for your assistance Thanks