Event-o-Pedia EventID 528 - Successful Logon [Win 2003]

	Event Details
	User Activity->Logons->Successful Logons->Windows 2000-2003->EventID 528 - Successful Logon [Win 2003]

EventID 528 - Successful Logon [Win 2003]

Linked Event:

EventID 528 - Successful Logon [Win 2003]

Sample:

        Event Type:     Success Audit
        Event Source:   Security
        Event Category: Logon/Logoff
        Event ID:       528
        Date:           11/2/2009
        Time:           05:47:29
        User:           RESEARCH\Ann_Benning
        Computer:       DC1
        Description:
        Successful Logon:
        User Name:	Paul
        Domain:		RESEARCH
        Logon ID:		(0x0,0x3A7A6E0)
        Logon Type:	2
        Logon Process:	seclogon
        Authentication Package:	Negotiate
        Workstation Name:	DC1
        Logon GUID:	{f6956476-dd7a-df4a-1006-c2026f6e3cc3}
        Caller User Name:	CBrown
        Caller Domain:	RESEARCH
        Caller Logon ID:	(0x0,0x697DC)
        Caller Process ID: 884
        Transited Services: -
        Source Network Address:	-
        Source Port:	-

Log Type:

Windows Event Log

Uniquely Identified By:

Log Name:

Security

Filtering Field	Equals to Value
OSVersion	Windows 2003
Source	Security
Category	Logon/Logoff
EventId	528
Expression	String4 != '2'

Field Matching

Field	Description	Stored in	Sample Value
When	At what date and time a user activity originated in the system.	DateTime	10.10.2000 19:00:00
Who	Account or user name under which the activity occured.	User Name	Paul
What	The type of activity occurred (e.g. Logon, Password Changed, etc.)	"Logon"	Logon
Where	The name of the workstation/server where the activity was logged.	Computer	DC1
Where From	The name of the workstation/server where the activity was initiated from.	Workstation Name	DC1
Severity	Specify the seriousness of the event.	"Medium"	Medium
WhoDomain		Domain	RESEARCH
WhereDomain		-
Result	Successful or Failed.	"Successful"	Successful
Failure Reason		"Successful"	Successful