02/28 15:32:10 [LOGON] Domain: SamLogon: Transitive Network logon of workstation\Administrator from workstation (via workstation) Entered 02/28 15:32:10 [LOGON] Domain: SamLogon: Transitive Network logon of workstation\Administrator from workstation (via workstation) Returns 0xC000006A I've seen a few entries like this in my NetLogon.Log...but this seems mysterious to me? What kind of action is causing a transitive network logon from a workstation to itself? Could this be generated by a user trying to remotely logon to 'workstation' using some sort of remote access client installed on 'workstation'?

another entry that has me confused: is this machine trying to access itself via UNC or something? 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Entered 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Returns 0xC000006A

Hi AJM-B, Thanks for your post. The Transitive Network logon means that the logon credential has been forwarded to the computer which has captured the log files. It is commonly referred to as pass-through authentication, and via indicated the source of the authentication. For detailed information about net logon debug, please refer to the following article: Maintaining and Monitoring Account Lockout http://technet.microsoft.com/en-us/library/cc776964(v=ws.10).aspx Track Net Logon Debug http://download.microsoft.com/download/a/8/7/a87526d3-b794-4d93-865a-07c9c2b076e4/TrackNetLogDebug.doc Best Regards, Aiden Aiden Cao TechNet Community Support

another entry that has me confused: is this machine trying to access itself via UNC or something? 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Entered 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Returns 0xC000006A I'm still a little confused about this one: what is happening on this workstation that it's making a network logon from itself, to itself?

I'm confused by this as well. I'm trying to track down a chronic lockout problem for a user and I'm seeing the same thing where SamLogon: Network logon of domain\user from servername Returns 0xc000234. servername = the server I'm remoted into. I've tracked the transitive logons back to this server, a domain controller, but now I'm seeing what looks like a loop. I've looked at taskman to make sure I don't see any processes using his username. Can anyone from MS shed some light on this?