Monday, May 07, 2012 3:17 AM
User name: abc$
Domain: Same domain.
1) I'm seeing some random log from the security audit, what network logon actually mean?
2) why the user name is marked with a '$' instead of normal abc?
Monday, May 07, 2012 7:43 AM
A network logon can only be used after a user, service, or computer authentication has taken place. During network logon, the process does not use the logon dialog boxes, such as the Log On to Windows dialog box, to collect data. Instead, previously established credentials or another method to collect credentials is used. This process confirms the users identification to any network service that the user is attempting to access. This process is typically invisible to the user unless alternate credentials need to be provided.
To provide this type of authentication, the security system includes these authentication mechanisms:
Public key certificates
Secure Sockets Layer/Transport Layer Security (SSL/TLS)
NTLM (for compatibility with Windows NT 4.0-based systems)
This posting is provided 'AS IS' with no warranties or guarantees and confers no rights.
Monday, May 07, 2012 10:11 AM
Thanks for the reply.
How about question 2) ? I still curious why the username is actually a hostname with $ sign appended like "abc$"
3) What actually can be done via Network Logon? I mean can some kind of malware/worm inject something to a shared folder/resource?
Friday, June 22, 2012 8:20 AM
Still seeking answer for 2) & 3)