> There are "User Logoff" and "Successful Logon" > events with the same timestamp in the security log. > Can some explain this.
There isn't enough information available to explain anything... What type of system is the Event Log in question from? Is it a PDC/BDC? What other information is available in the event records? Are all of these records for the same user? >From the same system? Are they local or network logins? ------------------------------------------ Harlan Carvey, CISSP "Windows Forensics and Incident Recovery" http://www.windows-ir.com http://windowsir.blogspot.com ------------------------------------------ --------------------------------------------------------------------------- ---------------------------------------------------------------------------
