Event ID: 528 Source: Security

Event ID/Source search

Keyword search

Example: Windows cannot unload your registry file

EvLog 3.0 – Monitor an unlimited number of servers with $49/year

With the current low prices for servers and the need for processing power, even a small company may end up with quite a few of them. If ten years ago it was still common to see an entire company using just one server, these days that's no longer the case.
New computers are added to the network with the understanding that they will be taken care of by the admins. Keeping an eye on these servers is a tedious, time-consuming process. Even with 5 minutes per server (to check the logs and other parameters), it may take an hour to make sure that everything is ok and no "red lights" are blinking on any of the servers.

Event ID: 528 Source: Security

Source: Security

Type: Success Audit

Description:
Successful Logon:
         User Name: <user name>
         Domain: <domain name>
         Logon ID: <logon identifier>
         Logon Type: <logon type>
         Logon Process: <logon process>
         Authentication Package: <package name>
         Workstation Name: <computer name>

English: This information is only available to subscribers. An example of English, please!

Concepts to understand:
What is an authentication protocol?

Comments:
EventID.Net
See the link to "Windows 2000 Magazine" for a complete overview on this event. Also, see ME320670.
Click if the comment is good!

^{x
8}

EventID.Net
This event informs you that a logon session was successfully created for the user. See MSW2KDB for information on the details present in the description (logon ID, GUID, etc).

When you turn on the Audit Logon Events feature to track logon and logoff events, you may receive logon event messages (Event 528 Type 2) in the security log. However, you may not receive user logoff event messages (Event 538 Type 2) in the security log. See ME828020 for a hotfix applicable to Microsoft Windows 2000. For additional information, see ME318253 and ME287537.

See "Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP" for detailed information about relevant security settings that you can configure on Microsoft Windows Server 2003 and Windows XP SP1.

See ME199472 and ME260835 for more details on this event.
Click if the comment is good!

^{x
14}

EventID.Net
A user or an application successfully logged on to a computer. A corresponding event id 538 will be recorded for the logoff. See the comments for event id 538. See ME274176 for more details.

For a list of logon types see the link to the "Windows Logon Types" article.

Information about the <authentication package> field found in the "Windows Authentication Packages" article.
Click if the comment is good!

^{x
8}

Private comment: Subscribers only. See example of private comment

Links: Windows Logon Types, Windows Logon Processes, Event ID 538, Windows Authentication Packages, Online Analysis of Security Event Log, Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP, Windows 2000 Magazine

Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...

Feedback: Send comments or solutions - Notify me when updated

Printer friendly