Event Details
User Activity->Logons->Successful Logons->Windows 2000-2003->EventID 528 - Successful Logon [Win XP]
EventID 528 - Successful Logon [Win XP]
 Sample:
        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Logon/Logoff
        Event ID:       528
        Date:           11/2/2009
        Time:           05:47:29
        User:           LOGISTISC\Alebovsky
        Computer:       DCCC1
        Description:
        Successful Logon:
 	User Name:	Alebovsky
 	Domain:		LOGISTICS
 	Logon ID:		(0x0,0xB3691)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	DCCC1
                     Logon GUID:	{d61ef524-7d6a-836f-00a1-eb9ffd13b431}
Log Type: Windows Event Log
 Uniquely Identified By:
Log Name: Security
Filtering Field Equals to Value
OSVersion Windows XP
Source Security
Category Logon/Logoff
EventId 528
Expression String4 != '2'
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime 12/14/2009 6:59:09 AM
Who Account or user name under which the activity occured. User Name Alebovsky
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Logon" Logon
Where The name of the workstation/server where the activity was logged. Computer DC1
Where From The name of the workstation/server where the activity was initiated from. Workstation Name DCCC1
Severity Specify the seriousness of the event. "Medium" Medium
WhoDomain Domain RESEARCH
WhereDomain -
Result Successful or Failed. "Successful" Successful
Failure Reason "Successful" Successful
Comments
You must be logged in to comment