Event Details
User Activity->Logons->Successful Logons->Windows 2000-2003->EventID 528 - Successful Logon [Win 2000]
EventID 528 - Successful Logon [Win 2000]
 Sample: 
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Logon/Logoff
        Event ID:       528
        Date:           11/2/2009
        Time:           05:47:29
        User:           LOGISTISC\Alebovsky
        Computer:       DCCC1
        Description:
        Successful Logon:
 	User Name:	Alebovsky
 	Domain:		LOGISTICS
 	Logon ID:		(0x0,0xB3691)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	DCCC1
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows 2000
Source Security
Category Logon/Logoff
EventId 528
Expression String4 != '2'
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 1/1/2000
Who Account or user name under which the activity occured. User Name Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Logon" Logon
Where The name of the workstation/server where the activity was logged. Computer
Where From The name of the workstation/server where the activity was initiated from. Workstation Name DCCC1
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Successful" Successful
Failure Reason "Successful" Successful
Comments
You must be logged in to comment