Among other servers, I have a couple of 2003 Standard servers (non-DC).
Tracking the security log I see events 582 and 582 occurring at the same time + the logon type is 2. however the server has no mouse, keyboard or monitor and I am the only person with physical access..
My question is: Why am I seeing these events and why is the logon type 2?
No services are running as administrator - only local system and network service..
The logged events are below..:
* Event Time: 04 Mar 2014 09:00:46 AM
* Source: Security
* Event Log: Security
* Type: Audit Success
* Event ID: 528
* Event User: DOMAINNAME\Administrator
* Successful Logon:
User Name: administrator
Domain: DOMAINNAME
Logon ID: (0x0,0x80F6ECF6)
Logon Type: 2
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name: SERVERNAME
Logon GUID: {c9854a34-f308-a07b-e7ae-164c5af5749f}
Caller User Name: SERVERNAME$
Caller Domain: DOMAIN
Caller Logon ID: (0x0,0x3E7)
Caller Process ID: 1332
Transited Services: -
Source Network Address: -
Source Port: -
-----------
* Event Time: 04 Mar 2014 09:00:46 AM
* Source: Security
* Event Log: Security
* Type: Audit Success
* Event ID: 538
* Event User: DOMAIN\Administrator
* User Logoff:
User Name: administrator
Domain: DOMAINNAME
Logon ID: (0x0,0x80F6ECF6)
Logon Type: 2