Click here to get back home

Any Way To Get Machine Name for Client in Event ID 560?
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Any Way To Get Machine Name for Client in Event ID 560? Will 11-13-2005
Posted by Will on November 13, 2005, 6:38 pm
Please log in for more thread options
 Is the client computer name somehow encoded into an Event ID 560 message?
I clearly see the domain and username, but I just can't believe that
Microsoft doesn't make the machine IP address and authenticated Windows
computer name visible in the event ID 560. That's very critical
information when you are trying to chase down a security breach.

--
Will




Posted by Steven L Umbach on November 13, 2005, 10:13 pm
Please log in for more thread options
 Since you know the user name you could look for logon events [assuming
auditing of logon events is enabled] for that user which should show the
computer name. --- Steve


> Is the client computer name somehow encoded into an Event ID 560 message?
> I clearly see the domain and username, but I just can't believe that
> Microsoft doesn't make the machine IP address and authenticated Windows
> computer name visible in the event ID 560. That's very critical
> information when you are trying to chase down a security breach.
>
> --
> Will
>
>




Posted by Will on November 13, 2005, 8:29 pm
Please log in for more thread options
Unfortunately, that part of the event log has been lost.

No alternatives?

--
Will


> Since you know the user name you could look for logon events [assuming
> auditing of logon events is enabled] for that user which should show the
> computer name. --- Steve
>
>
> > Is the client computer name somehow encoded into an Event ID 560
message?
> > I clearly see the domain and username, but I just can't believe that
> > Microsoft doesn't make the machine IP address and authenticated Windows
> > computer name visible in the event ID 560. That's very critical
> > information when you are trying to chase down a security breach.
> >
> > --
> > Will
> >
> >
>
>




Posted by Steven L Umbach on November 13, 2005, 10:37 pm
Please log in for more thread options
Not that I know of. --- Steve


> Unfortunately, that part of the event log has been lost.
>
> No alternatives?
>
> --
> Will
>
>
>> Since you know the user name you could look for logon events [assuming
>> auditing of logon events is enabled] for that user which should show the
>> computer name. --- Steve
>>
>>
>> > Is the client computer name somehow encoded into an Event ID 560
> message?
>> > I clearly see the domain and username, but I just can't believe that
>> > Microsoft doesn't make the machine IP address and authenticated Windows
>> > computer name visible in the event ID 560. That's very critical
>> > information when you are trying to chase down a security breach.
>> >
>> > --
>> > Will
>> >
>> >
>>
>>
>
>




Similar ThreadsPosted
saving event log to remote machine? November 16, 2006, 1:45 pm
NON STOP Event log -event id 538,540,576 September 2, 2007, 11:44 pm
Re: NON STOP Event log -event id 538,540,576 October 2, 2007, 2:44 pm
Machine does not respond. June 28, 2005, 12:42 pm
Add OS2 Client July 20, 2005, 3:42 pm
RDP Client & SSO September 6, 2005, 8:16 am
Security within Virtual Machine December 5, 2005, 6:16 am
machine authentication for web site? February 21, 2006, 10:09 am
.NET machine.config June 13, 2006, 1:01 pm
Where to View Machine Certificate? November 1, 2006, 2:25 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap