nevadafalo.blogg.se - Windows terminal services resources 2012

Logon ID is a semi-unique (unique between reboots) number that identifies the logon session.

Account Domain: The domain or - in the case of local accounts - computer name.

Free Active Directory Change Auditing Solution.

Windows Event Collection: Supercharger Free Edtion.

Free Security Log Quick Reference Chart.

With console logons and Fast User Switching the session name will be "Console" and Client Name: and Client Address: will be "unknown". The session name also indicates Remote Desktop with "RDP" as shown in the example. You can distinguish between instances of this event associated with Fast User Switching and Remote Desktop by Client Name: and Client Address: which in the case of Remote Desktop will normally be different than the local computer. This event is also logged when a user returns to an existing logon session via Fast User Switching. Windows logs this event when a user disconnects from a terminal server (aka remote desktop) session as opposed to an full logoff which triggers event 4647 or 4634. 4779: A session was disconnected from a Window Station