[logs] Windows Events - "User Account Created" and "Computer Account Created"

From: Brian Erdelyi (brian_erdelyi@private)
Date: Tue Oct 05 2004 - 11:30:59 PDT

I have a situation where a "User Account Created" was
logged unexpectedly.  I followed up and discovered
that a technician had installed a new computer and
added it to the domain.  I even verified by
correlating the event against user accounts and
computer accounts.

To summarize, Windows logged "User Account Created"
(EventID 624) instead of "Computer Account Created"
(EventID 645).  This is Windows NT 4 running as a
primary domain controller.  I'm certain the latest
service packs are installed and about to confirm.  I
could not find any relvevant MS knowledge base
articles or hits in Google.  Has anyone every seen
similar unusual behaviour?

Do you Yahoo!?
New and Improved Yahoo! Mail - 100MB free storage!
LogAnalysis mailing list

This archive was generated by hypermail 2.1.3 : Wed Oct 06 2004 - 23:02:29 PDT