讻讞诇拽 诪讛讘讚讬拽讜转 讛专讘讜转 砖讗谞讬 诪讘爪注 , 讗谞讬 诪转讬讞讞住 讙诐 诇EVENT LOGS 讘转讞谞讛 讜讘 DC 诇讙讘讬 讗讬专讜注讬 LOGON\OFF
讗讱 诪转拽砖讛 诇讝讻讜专 讗转 讛 EVENT ID 讛专诇讜讜谞讟讬讬诐.
讗讝 讛谞讛 专砖讬诪讛 拽爪专讛 诇转讝讻讜专转 (xp 2000):
诇专砖讬诪讛 讛诪诇讗讛:
http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/Default.aspx
528 - Successful Logon
529 - Logon Failure - Unknown user name or bad password
530 - Logon Failure - Account logon time restriction violation
531 - Logon Failure - Account currently disabled
533 - Logon Failure - User not allowed to logon at this computer
534 - Logon Failure - The user has not been granted the requested logon type at this machine
534 - Logon Failure - The user has not been granted the requested logon type at this machine
535 - Logon Failure - The specified account's password has expired
536 - Logon Failure - The NetLogon component is not active
537 - Logon failure - The logon attempt failed for other reasons
538 - User Logoff
539 - Logon Failure - Account locked out
551 - User initiated logoff
552 - Logon attempt using explicit credentials
682 - Session reconnected to winstation
683 - Session disconnected from winstation
