> There are "User Logoff" and "Successful Logon"
> events with the same timestamp in the security log.
> Can some explain this.
There isn't enough information available to explain
anything...
What type of system is the Event Log in question from?
Is it a PDC/BDC?
What other information is available in the event
records? Are all of these records for the same user?
From the same system? Are they local or network
logins?
> events with the same timestamp in the security log.
> Can some explain this.
There isn't enough information available to explain
anything...
What type of system is the Event Log in question from?
Is it a PDC/BDC?
What other information is available in the event
records? Are all of these records for the same user?
From the same system? Are they local or network
logins?
------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
[ reply ]