Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Windows Event: Logon Logoff
New Posts  All Forums:Forum Nav:

Windows Event: Logon Logoff

post #1 of 5
Thread Starter 
So I have a bunch of these in my windows event log.

EventData

TargetUserSid S-1-5-7
TargetUserName ANONYMOUS LOGON
TargetDomainName NT AUTHORITY
TargetLogonId 0x23d12bc
LogonType 3


Is that normal for when the conmputer is ideling?
Nightshade
(20 items)
 
  
CPUMotherboardGraphicsGraphics
i7-4930k Asus Rampage IV Extreme EVGA - Titan-X Superclocked EVGA - Titan-X 
RAMHard DriveHard DriveHard Drive
64 GB Corsair Vengance DDR3 OCZ Agility 3 Intel 540 240GB 7200 RPM Platter Drive 
Hard DriveCoolingOSMonitor
1TB Mushkin SSD Watercooled Windows 10 Pro x64 ASUS ROG Swift 
KeyboardPowerCaseMouse
Razer Black Widow Chroma Corsair RM1000 Corsair 900D Razer Deathadder Chroma 
Mouse PadAudioOther
Steelseries Soundblaster Z Speakers: Logitech z5500 
  hide details  
Reply
Nightshade
(20 items)
 
  
CPUMotherboardGraphicsGraphics
i7-4930k Asus Rampage IV Extreme EVGA - Titan-X Superclocked EVGA - Titan-X 
RAMHard DriveHard DriveHard Drive
64 GB Corsair Vengance DDR3 OCZ Agility 3 Intel 540 240GB 7200 RPM Platter Drive 
Hard DriveCoolingOSMonitor
1TB Mushkin SSD Watercooled Windows 10 Pro x64 ASUS ROG Swift 
KeyboardPowerCaseMouse
Razer Black Widow Chroma Corsair RM1000 Corsair 900D Razer Deathadder Chroma 
Mouse PadAudioOther
Steelseries Soundblaster Z Speakers: Logitech z5500 
  hide details  
Reply
post #2 of 5
Windows logs 'logon type 3' in most cases when you access a computer from elsewhere on the network. One of the most common sources of logon events with logon type 3 is connections to shared folders or printers etc so do you have any other PCs or systems on your home LAN?

Great list here.
    
CPUMotherboardGraphicsRAM
Intel i7 930 Gigabyte GA-X58A-UD3R EVGA GTX680 4Gb FTW 6Gb Corsair XMS3 Classic 
Hard DriveHard DriveCoolingOS
2 x Kingston 120Gb SSD RAID (Boot) 4 x 1Tb Samsung Spinpoints Corsair H80i Windows 8 Pro 
MonitorKeyboardPowerCase
Samsung 24" LED QPad MK85 (Cherry Red) Corsair TX850 Fractal Design R3 
MouseMouse Pad
Zowie EC1 eVo Zowie Swift 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
Intel i7 930 Gigabyte GA-X58A-UD3R EVGA GTX680 4Gb FTW 6Gb Corsair XMS3 Classic 
Hard DriveHard DriveCoolingOS
2 x Kingston 120Gb SSD RAID (Boot) 4 x 1Tb Samsung Spinpoints Corsair H80i Windows 8 Pro 
MonitorKeyboardPowerCase
Samsung 24" LED QPad MK85 (Cherry Red) Corsair TX850 Fractal Design R3 
MouseMouse Pad
Zowie EC1 eVo Zowie Swift 
  hide details  
Reply
post #3 of 5
Thread Starter 
Only one but it appears here
SubjectUserSid S-1-0-0
SubjectUserName -
SubjectDomainName -
SubjectLogonId 0x0
TargetUserSid S-1-5-7
TargetUserName ANONYMOUS LOGON
TargetDomainName NT AUTHORITY
TargetLogonId 0x23d12ad
LogonType 3
LogonProcessName NtLmSsp
AuthenticationPackageName NTLM
WorkstationName MEDIA-CENTER
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName NTLM V1
KeyLength 128
ProcessId 0x0
ProcessName -
IpAddress fe80::90a6:a576:356e:fe8a
IpPort 51412

Most notable part of that is "Media-Center"

What the heck is logging on to my guest account? Suppose I could just disable it and see what happens
Nightshade
(20 items)
 
  
CPUMotherboardGraphicsGraphics
i7-4930k Asus Rampage IV Extreme EVGA - Titan-X Superclocked EVGA - Titan-X 
RAMHard DriveHard DriveHard Drive
64 GB Corsair Vengance DDR3 OCZ Agility 3 Intel 540 240GB 7200 RPM Platter Drive 
Hard DriveCoolingOSMonitor
1TB Mushkin SSD Watercooled Windows 10 Pro x64 ASUS ROG Swift 
KeyboardPowerCaseMouse
Razer Black Widow Chroma Corsair RM1000 Corsair 900D Razer Deathadder Chroma 
Mouse PadAudioOther
Steelseries Soundblaster Z Speakers: Logitech z5500 
  hide details  
Reply
Nightshade
(20 items)
 
  
CPUMotherboardGraphicsGraphics
i7-4930k Asus Rampage IV Extreme EVGA - Titan-X Superclocked EVGA - Titan-X 
RAMHard DriveHard DriveHard Drive
64 GB Corsair Vengance DDR3 OCZ Agility 3 Intel 540 240GB 7200 RPM Platter Drive 
Hard DriveCoolingOSMonitor
1TB Mushkin SSD Watercooled Windows 10 Pro x64 ASUS ROG Swift 
KeyboardPowerCaseMouse
Razer Black Widow Chroma Corsair RM1000 Corsair 900D Razer Deathadder Chroma 
Mouse PadAudioOther
Steelseries Soundblaster Z Speakers: Logitech z5500 
  hide details  
Reply
post #4 of 5
Yes, even though your computer isn't doing anything, other machines might be communicating with it, such a router or server.
post #5 of 5
Yeah thats fine, its just Windows using the NTLMSSP (NT LAN Manager Security Support Provider) for Windows to Windows communications.

Best to check Audit log, will show if anybody actually connected to your PC.

Bottom line nothing to worry about, shows up in mine as well and I sit behind a Cisco Router with Hardware firewall etc.
    
CPUMotherboardGraphicsRAM
Intel i7 930 Gigabyte GA-X58A-UD3R EVGA GTX680 4Gb FTW 6Gb Corsair XMS3 Classic 
Hard DriveHard DriveCoolingOS
2 x Kingston 120Gb SSD RAID (Boot) 4 x 1Tb Samsung Spinpoints Corsair H80i Windows 8 Pro 
MonitorKeyboardPowerCase
Samsung 24" LED QPad MK85 (Cherry Red) Corsair TX850 Fractal Design R3 
MouseMouse Pad
Zowie EC1 eVo Zowie Swift 
  hide details  
Reply
    
CPUMotherboardGraphicsRAM
Intel i7 930 Gigabyte GA-X58A-UD3R EVGA GTX680 4Gb FTW 6Gb Corsair XMS3 Classic 
Hard DriveHard DriveCoolingOS
2 x Kingston 120Gb SSD RAID (Boot) 4 x 1Tb Samsung Spinpoints Corsair H80i Windows 8 Pro 
MonitorKeyboardPowerCase
Samsung 24" LED QPad MK85 (Cherry Red) Corsair TX850 Fractal Design R3 
MouseMouse Pad
Zowie EC1 eVo Zowie Swift 
  hide details  
Reply
New Posts  All Forums:Forum Nav:
  Return Home
  Back to Forum: Windows
Overclock.net › Forums › Software, Programming and Coding › Operating Systems › Windows › Windows Event: Logon Logoff