Details | ||||||||||||||||||||||||||||
Product: | Windows Operating System | |||||||||||||||||||||||||||
Event ID: | 540 | |||||||||||||||||||||||||||
Source: | Security | |||||||||||||||||||||||||||
Version: | 5.0 | |||||||||||||||||||||||||||
Symbolic Name: | SE_AUDITID_NETWORK_LOGON | |||||||||||||||||||||||||||
Message: | Successful Network Logon: User Name: %1 Domain: %2 Logon ID: %3 Logon Type: %4 Logon Process: %5 Authentication Package: %6 Workstation Name: %7 Logon GUID: %8 Caller User Name: %9 Caller Domain: %10 Caller Logon ID: %11 Caller Process ID: %12 Transited Services: %13 Source Network Address: %14 Source Port: %15 | |||||||||||||||||||||||||||
Explanation | ||||||||||||||||||||||||||||
A logon session was created for the user. The message contains the Logon ID, a number that is generated when a user logs on to a computer. The Logon ID that is assigned to a logon session is unique to that logon session until the computer is restarted, at which point the Logon ID may be reused. The Logon ID can be used to correlate a logon message with other messages, such as object access messages. This message includes the user name and the domain information of the user account that was logged on, the name of the logon process that logged the user on, the type of authentication credentials that were presented, and a logon GUID (globally unique identifier). For logons that use Kerberos, the logon GUID can be used to associate a logon event on this computer with an account logon event on an authenticating computer, such as a domain controller. This message also includes a logon type code. The logon type code indicates the manner in which the user logged on. The following table explains the logon type value:
|
||||||||||||||||||||||||||||
User Action | ||||||||||||||||||||||||||||
No user action is required. |