[logs] Windows Events - "User Account Created" and "Computer Account Created"

Previous message: Tina Bird: "Re: [logs] Cisco introduces login logging enhancement"
Next in thread: Harlan Carvey: "Re: [logs] Windows Events - &quot;User Account Created&quot; and &quot;Computer Account Created&quot;"
Reply: Harlan Carvey: "Re: [logs] Windows Events - &quot;User Account Created&quot; and &quot;Computer Account Created&quot;"
Reply: Adrian Grigorof: "Re: [logs] Windows Events - &quot;User Account Created&quot; and &quot;ComputerAccount Created&quot;"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

brian_erdelyi@private

I have a situation where a "User Account Created" was
logged unexpectedly.  I followed up and discovered
that a technician had installed a new computer and
added it to the domain.  I even verified by
correlating the event against user accounts and
computer accounts.

To summarize, Windows logged "User Account Created"
(EventID 624) instead of "Computer Account Created"
(EventID 645).  This is Windows NT 4 running as a
primary domain controller.  I'm certain the latest
service packs are installed and about to confirm.  I
could not find any relvevant MS knowledge base
articles or hits in Google.  Has anyone every seen
similar unusual behaviour?

__________________________________
Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
http://promotions.yahoo.com/new_mail 
_______________________________________________
LogAnalysis mailing list
LogAnalysis@private
http://lists.shmoo.com/mailman/listinfo/loganalysis