missing information
Hi All I have a concern about some missing information. While viewing the security logs on my server I ocassionaly run into this. Subject: Security ID: NULL SID Account Name: - Account Domain: - Logon ID: 0x0 Logon Type: 3 New Logon: Security ID: SYSTEM Account Name: MySystem$ Account Domain: My Domain Logon ID: 0x5ff84fc Logon GUID: {e8082173-a5ce-7f74-d124-97c8526e1bf2} Process Information: Process ID: 0x0 Process Name: - Network Information: Workstation Name: Source Network Address: 192.168.1.2 Source Port: 15760 Detailed Authentication Information: Logon Process: Kerberos Authentication Package: Kerberos Transited Services: - Package Name (NTLM only): - Key Length: 0 The Information in the subject field is left blank , Where is this information stored? and what is it I need to do to acquire it?
July 8th, 2011 7:06pm

Hi, Are you referring to event 4625? There are some good links explaining each field: http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4625 http://support.microsoft.com/kb/2157973 Let me know if it helps move further.Ketan Thakkar | Microsoft Online Community Support
Free Windows Admin Tool Kit Click here and download it now
July 15th, 2011 8:28am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics