Event Details
User Activity->Logons->Successful Logons->Windows 2000-2003->EventID 682 - Session reconnected to winstation
EventID 682 - Session reconnected to winstation
 Sample: 
Event Type:	                     Success Audit
Event Source:	Security
Event Category:	Logon/Logoff 
Event ID:	                     682
Date:		06.12.2010
Time:		11:43:52
User:		NT AUTHORITY\SYSTEM
Computer:	                     DC1
Description:
Session reconnected to winstation:
 	User Name:	                      CBrown
 	Domain:		 RESEARCH
 	Logon ID:		 (0x0,0x5AE818)
 	Session Name:	 RDP-Tcp#5
 	Client Name:	                      DCCC1
 	Client Address:	10.30.34.58
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Source Security
Category Logon/Logoff
EventId 682
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name CBrown
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Session Reconnected" Session Reconnected
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. Client Name DCCC1
Severity Specify the seriousness of the event. "Low" Low
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Successful" Successful
Failure Reason "Successful" Successful
Comments
You must be logged in to comment