deciphering security log events

I'm trying to find out information on what the Logon ID: (0x0....) number represents. Example from below:

Event Type:      Success Audit
Event Source:      Security
Event Category:      Logon/Logoff
Event ID:      538
Date:            8/9/2004
Time:            9:14:02 AM
User:            NT AUTHORITY\SYSTEM
Computer:      COMPUTERNAME
Description:
User Logoff:
       User Name:      COMPUTERNAME$
       Domain:            DOMAIN
       Logon ID:            (0x0,0x13E1295)
       Logon Type:      3

Is there a way to decipher that?

Tony

townsendraAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Yan_westConnect With a Mentor Commented:
Eric Fitzgerald of Microsoft has explained this:

Whenever a user logs on, a logon session is created that is uniquely identified with a number, called Logon ID which is logged as a parameter with the event in the Windows Security Log. Similarly, when a user log offs, then under normal conditions, this logon session is destroyed and an entry is made into the Windows Security Log with a Logon ID similar to the one with which the session was created. In other words, we can correlate these log on and log off events based on the Logon IDs and irrespective of the Log on type that is mentioned above.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.