Re: [logs] Windows Events - "User Account Created" and "Computer Account Created"

From: Harlan Carvey (keydet89@private)
Date: Thu Oct 07 2004 - 03:33:26 PDT


> To summarize, Windows logged "User Account Created"
> (EventID 624) instead of "Computer Account Created"
> (EventID 645).  This is Windows NT 4 running as a
> primary domain controller.  I'm certain the latest
> service packs are installed and about to confirm.  I
> could not find any relvevant MS knowledge base
> articles or hits in Google.  Has anyone every seen
> similar unusual behaviour?

This very may well have been expected behaviour, by
design.  Have you attempted to replicate it in any way?

Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"

"Meddle not in the affairs of dragons, for
you are crunchy, and good with ketchup."

"The simplicity of this game amuses me. 
Bring me your finest meats and cheeses."
LogAnalysis mailing list

This archive was generated by hypermail 2.1.3 : Thu Oct 07 2004 - 10:38:13 PDT