Dear ALL,
When we trying to take remote desktop of my server 2008 after putting username & password some times access denied comes. Whereas sometimes logging successfully. The EVENT VIEWER LOG FILE is as follows.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 07-Aug-12 4:07:33 PM
Event ID: 4634
Task Category: Logoff
Level: Information
Keywords: Audit Success
User: N/A
Computer: JCIAOS.NEWDOMAIN.COM
Description:
An account was logged off.
Subject:
Security ID: NEWDOMAIN\bennyadmin
Account Name: bennyadmin
Account Domain: NEWDOMAIN
Logon ID: 0x2ad06b99
Logon Type: 10
This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
<EventID>4634</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>12545</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2012-08-07T10:37:33.425Z" />
<EventRecordID>261668</EventRecordID>
<Correlation />
<Execution ProcessID="588" ThreadID="712" />
<Channel>Security</Channel>
<Computer>JCIAOS.NEWDOMAIN.COM</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserSid">S-1-5-21-1835825263-2259512572-530060612-3463</Data>
<Data Name="TargetUserName">bennyadmin</Data>
<Data Name="TargetDomainName">NEWDOMAIN</Data>
<Data Name="TargetLogonId">0x2ad06b99</Data>
<Data Name="LogonType">10</Data>
</EventData>
</Event>