Event Details
User Activity->Logons->Successful Logons->Windows 2000-2003->EventID 683 - Session disconnected from winstation
EventID 683 - Session disconnected from winstation
 Sample: 
Event Type:	Success Audit
Event Source:	Security
Event Category:	Logon/Logoff 
Event ID:	683
Date:		06.12.2010
Time:		11:43:50
User:		NT AUTHORITY\SYSTEM
Computer:	                     DC1
Description:
Session disconnected from winstation:
 	User Name:	                     CBrown
 	Domain:		RESEARCH
 	Logon ID:		(0x0,0x5AE818)
 	Session Name:	RDP-Tcp#3
 	Client Name:	                      DCCC1
 	Client Address:	10.30.34.58
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Windows XP
Windows 2003
Source Security
Category Logon/Logoff
EventId 683
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name CBrown
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Session Disconnected" Session Disconnected
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. Client Name DCCC1
Severity Specify the seriousness of the event. "Low" Low
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Successful" Successful
Failure Reason "Successful" Successful
Comments
You must be logged in to comment