just to clarify the "machine" part for Dennis: this means that some process is either running as "Local System" or "NT AUTHORITY\NetworkService" - this would typically be some service installed on the machine. It is then able to leverage the machine-account's credentials from AD to connect to resources in the network, such as to a share of your application server.
/Guido -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of joe Sent: Sunday, February 27, 2005 8:05 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Computer Accounts logging onto servers That simply means a machine attached to the server across the network. It could be anything, best thing would be to go to those machines and try to see what they are doing or set up a network sniffer and watch the traffic coming in from them. In summary, could be a virus or a worm, could be something else. joe -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dennis Depp Sent: Sunday, February 27, 2005 1:40 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Computer Accounts logging onto servers I have a Sys admin who is seeing two computer accounts logging on to one of her applications servers. The computer account logs on with a logon type 3 and then logs off. This admin is thinking something nefarious is going on, while I do not. Does anyone know what might be causing the computer accounts to logon to an application server? Thanks Dennis List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
