Home | Site Map | How To | Windows Vista | Case Studies | Articles | Forums | Services | Donations | Careers | About Us | Contact Us|

Event ID 552 - Logon attempt using explicit credentials

Symptoms: 1. A TS user account is locked after he accesses the Terminal server.

2. Event ID 552 I slogged with this message:

Logon attempt using explicit credentials:
Logged on user:
User Name: rlin
Domain: chicagotech
Logon ID: (0x0,0x3E7)
Logon GUID: -
User whose credentials were used:
Target User Name: blin
Target Domain: chicagotech
Target Logon GUID:

Causes: the user logon using rlin and then work on some things using different username, blin in our case.

Case 1: The user rlin tried to remote access the LAN with a batch file including  this command: “net use h: \\chicagotech\shared /u:blin”

Case 2: the user rlin tested scheduled Tasks using username blin.

Case 3: the user blin tried to use Runas with administrator ID.

Related Topics