Event Viewer

  • Thread starter Thread starter CC
  • Start date Start date
C

CC

Why does a coworker's userID appear as a user in my Event Viewer
Security Log so often??

Here's an example..
Date: 12/5/2003 Source: Security
Time: 8:00 Category: Logon/Logoff
Type: Success Event ID: 540 (sometimes says 538)
User: OurDomainName\HisUserID
Computer: MycomputerName

Successful Network Logon:
User Name: HisUserID
Domain
Logon ID: (0x0,0x2SAF83B)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:

This seemed to have started when I logged into our network on his
laptop to install a VB program. We both use Windows 2000 (though I
have a desktop). Is it possible it has anything to do with MSN
Messenger? I seem to get an entry in my Security Log every time he
starts his Messenger.

Please Help!! Doesn't look good to have his name all over my security
log!
I'm not very familiar with security, so pardon me if I'm posting to
the wrong place.
 
The link below explains some of the Event ID's you are seeing. He is authenticating
against your computer for some reason and probably nothing to worry about. You could
try to temporarily add his user account to "deny access to this computer from the
network" user right in Local Security Policy and reboot. Then he should get some
error message on his computer when the application/process that needs authentication
fails. --- Steve

http://is-it-true.org/nt/atips/atips155.shtml
 
Thanks for your help, Steve. I think I figured out what is happening.
When I installed the VB program on his PC, I also added a network
Zebra printer that I had shared out (the printer is attached to my
PC). It appears as though every time he logs in to the network, it
tries to do some sort of handshake with my printer and adds his name
to my log.
 
Back
Top