|
Re: Paranoid or Poirot?
EventData
SubjectUserSid S-1-5-21-2617509925-2813344812-3838341493-1000
SubjectUserName Lloydy
SubjectDomainName Lloydy-PC
SubjectLogonId 0x2e6d3
TargetUserSid S-1-5-21-2617509925-2813344812-3838341493-501
TargetUserName Guest
TargetDomainName Lloydy-PC
TargetLogonId 0x8d49ee
LogonType 3
LogonProcessName Advapi
AuthenticationPackageName Negotiate
WorkstationName LLOYDY-PC
LogonGuid {00000000-0000-0000-0000-000000000000}
TransmittedServices -
LmPackageName -
KeyLength 0
ProcessId 0xd1c
ProcessName C:\Windows\explorer.exe
IpAddress -
IpPort -
I also thought this one looks weird because of the Guest status of target username? |