We are currently doing security audits on login attempts on specific workstations in our domain and I am seeing that the Event ID 540 entries (DC security log) are sometimes missing the Workstation entry. I've seen it happen either way on specific workstations: one time the user logs in and the workstation ID is mentioned, and the next instance for the same user the workstation is not listed. Does anyone have any idea why the workstation is not being consistently identified in the login entries?
Gideon Ashcraft Network Adminstrator Screen Actors Guild List info : http://www.activedir.org/mail_list.htm List FAQ : http://www.activedir.org/list_faq.htm List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
