Event ID 552

Chicago Area Laptop for rent: $35 per day plus $10 for additional day

Event ID 552 - Logon attempt using explicit credentials

Symptoms: 1. A TS user account is locked after he accesses the Terminal server.

2. Event ID 552 I slogged with this message:

Logon attempt using explicit credentials:
Logged on user:
User Name: rlin
Domain: chicagotech
Logon ID: (0x0,0x3E7)
Logon GUID: -
User whose credentials were used:
Target User Name: blin
Target Domain: chicagotech
Target Logon GUID:

Causes: the user logon using rlin and then work on some things using different username, blin in our case.

Case 1: The user rlin tried to remote access the LAN with a batch file including this command: “net use h: \\chicagotech\shared /u:blin”

Case 2: the user rlin tested scheduled Tasks using username blin.

Case 3: the user blin tried to use Runas with administrator ID.

Related Topics

Event ID Troubleshooting

Event ID: 2011 - Not enough server storage is available to process this command. ... Event ID 5719 - The system cannot log you on now because the domain ...
www.chicagotech.net/wineventid.htm

security

If you want to prevent only certain files or subfolders from inheriting permissions, right-click the file or subfolder, click Properties, click the Security ...
www.chicagotech.net/security.htm

Bob Lin Photography services

Real Estate Photography services