02/28 15:32:10 [LOGON] Domain: SamLogon: Transitive Network logon of workstation\Administrator from workstation (via workstation) Entered 02/28 15:32:10 [LOGON] Domain: SamLogon: Transitive Network logon of workstation\Administrator from workstation (via workstation) Returns 0xC000006A I've seen a few entries like this in my NetLogon.Log...but this seems mysterious to me? What kind of action is causing a transitive network logon from a workstation to itself? Could this be generated by a user trying to remotely logon to 'workstation' using some sort of remote access client installed on 'workstation'?

another entry that has me confused: is this machine trying to access itself via UNC or something? 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Entered 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Returns 0xC000006A

another entry that has me confused: is this machine trying to access itself via UNC or something? 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Entered 02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Returns 0xC000006A I'm still a little confused about this one: what is happening on this workstation that it's making a network logon from itself, to itself?

I'm confused by this as well. I'm trying to track down a chronic lockout problem for a user and I'm seeing the same thing where SamLogon: Network logon of domain\user from servername Returns 0xc000234. servername = the server I'm remoted into. I've tracked the transitive logons back to this server, a domain controller, but now I'm seeing what looks like a loop. I've looked at taskman to make sure I don't see any processes using his username. Can anyone from MS shed some light on this?