missing information
Hi All
I have a concern about some missing information.
While viewing the security logs on my server I ocassionaly run into this.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
New Logon:
Security ID: SYSTEM
Account Name: MySystem$
Account Domain: My Domain
Logon ID: 0x5ff84fc
Logon GUID: {e8082173-a5ce-7f74-d124-97c8526e1bf2}
Process Information:
Process ID: 0x0
Process Name: -
Network Information:
Workstation Name:
Source Network Address: 192.168.1.2
Source Port: 15760
Detailed Authentication Information:
Logon Process: Kerberos
Authentication Package: Kerberos
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
The Information in the subject field is left blank , Where is this information stored?
and what is it I need to do to acquire it?
July 8th, 2011 7:06pm
Hi,
Are you referring to event 4625?
There are some good links explaining each field:
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4625
http://support.microsoft.com/kb/2157973
Let me know if it helps move further.Ketan Thakkar | Microsoft Online Community Support
Free Windows Admin Tool Kit Click here and download it now
July 15th, 2011 8:28am