User Authentication

[Guest]

I have a user ID that is trying to log on to my main dc from a file server. I
have if any services are running from this account (None) I have checked if
any apps are using the id (None). The user itself has no access to these
systems. Is there a way to find out why this id is trying to log on from the
file server? Maybe a way to trace from the DC back to file server?

 

[Paul Bergson]

Go into Task Manager and check the services (Make sure you have added the
user column).

Go into services and check to make sure that this id isn't listed as the
logon id.

Go into Event Viewer and check to see if you are getting any errors.


If none of this helps review the link below to try and track down the
offending Id. EventCombo can be of great assistance.

http://www.microsoft.com/downloads/...familyid=7af2e69c-91f3-4e63-8629-b999adde0b9e

 

[Guest]

Paul.

Thanks for the post excellent tool. Ran it and most of the info that is
returned comes from the success audit from the DC's security log. I may not
have stated that in my earlier post. I still need to track down why this
account is trying to access the DC from the file server......