|
Posted by r. wales on April 4, 2006, 9:33 am
Please log in for more thread options Thanks Steve. That is kind of what I suspected and I did scour the logs for
suspicious failures, but it is good to get some reinforcement. Would I be
correct is also assuming that caller logon id: (0x0, 0x3E7) is a system ID?
"Steven L Umbach" wrote:
> Most likely it means that the computer account password was changed which is
> done periodically and automatically - around every thirty days I believe if
> a domain controller can be contacted. I would not worry about it. Intrusions
> are more evidence by password failures particularly for administrator
> account. You might find the link below helpful. --- Steve
>
>
http://www.microsoft.com/technet/security/topics/auditingandmonitoring/securitymonitoring/default.mspx
>
> >I have several events that are being logged with caller logon id:
> > (0x0,0x3E7). Target accounts are ususally <computername>$ and the caller
> > user name is <servername>$. Who or what does (0x0,0x3E7) specify?
> >
> > [AD domain, win 2003 standard, xp clients]
> >
> > One of these events was a 'computer account change' that occured at 9:21
> > am
> > Sunday morning (no one in the building). The only thing it lists is a
> > value
> > for "password last set". Could this indicate intrusion?
>
>
>
| 
XML Sitemap