Thanks for the links and they were informative. I am still reviewing the data in these pages. Is there and explanation for the event in the following screenshot that I have attached? Notice that the User logon is not NT AUTHORITY\SYSTEM but an actual domain\username. I know for a fact that this event was caused by the restarting of an application Service. In most cases, the User Logon is NT AUTHORITY\SYSTEM, however, that is not the case here. This defies all Windows logic and theory. I cannot replicate or debug why the user login is in the form of domain\username and not NT AUTHORITY\SYSTEM . Thank You for any thoughts or details.
Main Topics
Browse All Topics
by: PberPosted on 2009-05-12 at 11:12:58ID: 24367471
The "User:" definition is this case is indicating that the SYSTEM account is the service running under the OS that servicing the logon request from the computer MAILCR.
This explains the logon process well under the "Bottom Line":
http://www.mail-archive.co
Next lets look at logon types. This displays some of the common ones:
http://www.windowsnetworki
In this case you have a logon type of 3 which indicates a Network Logon. This means this logon was initiated over a network such as someone accessing the computers share.
The EventId of 540 corroborates the event id of 3 as both are indications of Network logons.
http://technet.microsoft.c
See these for further info:
http://www.experts-exchang
http://www.ultimatewindows