Unanswered Successful Network Logon

  • Monday, May 07, 2012 3:17 AM
     
     

    User name: abc$

    Logon Type:3

    Domain: Same domain.

    1) I'm seeing some random log from the security audit, what network logon actually mean?

    2) why the user name is marked with a '$' instead of normal abc?

All Replies

  • Monday, May 07, 2012 7:43 AM
     
     

    Hi,

    Network Logon
    A network logon can only be used after a user, service, or computer authentication has taken place. During network logon, the process does not use the logon dialog boxes, such as the Log On to Windows dialog box, to collect data. Instead, previously established credentials or another method to collect credentials is used. This process confirms the users identification to any network service that the user is attempting to access. This process is typically invisible to the user unless alternate credentials need to be provided.

    To provide this type of authentication, the security system includes these authentication mechanisms:

    Kerberos V5

    Public key certificates

    Secure Sockets Layer/Transport Layer Security (SSL/TLS)

    Digest

    NTLM (for compatibility with Windows NT 4.0-based systems)

    http://technet.microsoft.com/en-us/library/cc780455(v=ws.10).aspx


    Kind regards,

    Tim
    MCITP, MCTS
    http://directoryadmin.blogspot.com

    This posting is provided 'AS IS' with no warranties or guarantees and confers no rights.

  • Monday, May 07, 2012 10:11 AM
     
     

    Thanks for the reply.

    How about question 2) ? I still curious why the username is actually a hostname with $ sign appended like "abc$"

    3) What actually can be done via Network Logon? I mean can some kind of malware/worm inject something to a shared folder/resource?

    Regards

  • Friday, June 22, 2012 8:20 AM
     
     

    Bump.

    Still seeking answer for 2) & 3)

    Thanks!!