Event Details
User Activity->Logons->Failed Logons->Windows 2000-2003->EventID 548 - Domain SID is inconsistent
EventID 548 - Domain SID is inconsistent
 Sample: 
   Event Type:        Failure Audit
   Event Source:     Security
   Event Category: Logon/Logoff
   Event ID:            548
   Date:                  11.12.2008
   Time:                   2:00:49
   User:                   NT AUTHORITY\SYSTEM
   Computer:          DCC
   Description:
     Logon Failure.
     Reason:                 Domain sid inconsistent
     User Name:           ALebovsky
     Domain:                 LOGISTICS
     Logon Type:          3
     Logon Process:      NtLmSsp
     Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
     Workstation Name:       DCC
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Source Security
Category Logon/Logoff
EventId 548
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name
What The type of activity occurred (e.g. Logon, Password Changed, etc.) Category Logon
Where The name of the workstation/server where the activity was logged. Computer 10.10.10.10
Where From The name of the workstation/server where the activity was initiated from. Workstation Name
Severity Specify the seriousness of the event. "High" High
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Failed" Failed
Failure Reason Failure Reason - Bad user name or password, not enough privileges, etc. "Domain SID is inconsistent" Domain SID is inconsistent
Comments
You must be logged in to comment