[logs] RE: LogAnalysis Digest, Vol 2, Issue 7

Previous message: Eric Fitzgerald: "RE: [logs] Comments on Event ID 538 Explained"
Next in thread: Eric Fitzgerald: "[logs] RE: LogAnalysis Digest, Vol 2, Issue 7"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

gord.taylorat_private

>Eric Fitzgerald <ericfat_private> wrote:
>Actually the disparity between logon & logoff events is usually due to
token leaks

So, does a 538 occur if the machine is undocked/when the machine blue
screens/power button is hit? If so, is this after the server's configured
disconnect time, or immediately when the TCP session disconnects at the
client?

Thanks
Gord T.

------------------------------------------------------------
This e-mail may be privileged and/or confidential, and the sender does not
waive any related rights and obligations. Any distribution, use or copying of
this e-mail or the information it contains by other than an intended recipient
is unauthorized. If you received this e-mail in error, please advise me (by
return e-mail or otherwise) immediately. 

Ce courrier électronique est confidentiel et protégé. L'expéditeur ne renonce
pas aux droits et obligations qui s'y rapportent. Toute diffusion, utilisation
ou copie de ce message ou des renseignements qu'il contient par une personne
autre que le (les) destinataire(s) désigné(s) est interdite. Si vous recevez
ce courrier électronique par erreur, veuillez m'en aviser immédiatement, par
retour de courrier électronique ou par un autre moyen.

============================================================

_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis