Windows Security Logging and Other Esoterica

DISCLAIMER: To the best of my knowledge the information here is correct. However the lawyers make me say, that this information is provided "AS-IS" with no warranty, and confers no rights. In other words, if this stuff isn't in SP1, you can't sue us, Read More...

Logon events. Event 528 and Event 540 are the Logon events. Event 528 is for all logons except "network" logons. "Network" logons are SMB/Microsoft-DS logons (i.e. connecting to a share). RDP, IIS, FTP logons, etc., are event 528 even though credentials Read More...