Event ID 540

[Vic]

Archived from groups: microsoft.public.win2000.security (More info?)

I found the following in my event viewer in the Success
Audit Properties:

Date 9/6/2004
Source: Security
Time 10:03
Category: logon/Logoff
Type: Success
Event ID: 540
User: DOMAINNAME\bsmith
Computer: NAMEOFSERVER

Successful Network Logon:
UserName: bsmith
Domain: DOMAINNAME
Logon ID: (0x0,0x2 etc)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:

bsmith has admin rights. The office was closed on
9/6/2004 as it was Labor Day and no one was here.

This is from a Windows 2000 server. Is there anything to
worry about? What does this mean?
Thanks for any help.

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

I also have SP4 on the server. And, a few seconds later I
got a Event ID 538 with the bsmith username, DOMAIN name,
logon id and Logon Type 3.

I appreciate any insight on these events.
>-----Original Message-----
>I found the following in my event viewer in the Success
>Audit Properties:
>
>Date 9/6/2004
>Source: Security
>Time 10:03
>Category: logon/Logoff
>Type: Success
>Event ID: 540
>User: DOMAINNAME\bsmith
>Computer: NAMEOFSERVER
>
>Successful Network Logon:
>UserName: bsmith
>Domain: DOMAINNAME
>Logon ID: (0x0,0x2 etc)
>Logon Type: 3
>Logon Process: Kerberos
>Authentication Package: Kerberos
>Workstation Name:
>
>bsmith has admin rights. The office was closed on
>9/6/2004 as it was Labor Day and no one was here.
>
>This is from a Windows 2000 server. Is there anything to
>worry about? What does this mean?
>Thanks for any help.
>
>.
>

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

A user can still generate a logon even if he is not present. Reasons could be a user
not logging off or the use of credentials for a service, Sheduled Task, etc. ---
Steve


"vic" <anonymous@discussions.microsoft.com> wrote in message
news:7fc201c495a4$8e731b60$a601280a@phx.gbl...
>I found the following in my event viewer in the Success
> Audit Properties:
>
> Date 9/6/2004
> Source: Security
> Time 10:03
> Category: logon/Logoff
> Type: Success
> Event ID: 540
> User: DOMAINNAME\bsmith
> Computer: NAMEOFSERVER
>
> Successful Network Logon:
> UserName: bsmith
> Domain: DOMAINNAME
> Logon ID: (0x0,0x2 etc)
> Logon Type: 3
> Logon Process: Kerberos
> Authentication Package: Kerberos
> Workstation Name:
>
> bsmith has admin rights. The office was closed on
> 9/6/2004 as it was Labor Day and no one was here.
>
> This is from a Windows 2000 server. Is there anything to
> worry about? What does this mean?
> Thanks for any help.
>