playsafe

On same road at the end you can see their Flying Carrier

I have now enable auditing on this member server as well, it was just that this server got missed and I have to check for an incident on server. Thanks a lot for your replies and guidance.

@MrJinje I am looking for remote desktop (yes interactively) into a member server (Win 2003). The below logs are from my domain controller which has auditing enabled. The user in question has part of I.T team and has appropriate rights to logon to this server officially. I just wanted to check against an event that happened on member server. @cluberti The auditing is not enabled on member server but it is enabled on domain controller, my point was if authentication request goes to domain controller it may hold some related logs. And I found those from domain controller but just want to confirm if it was access to a share or interactive remote desktop as both could initiate the authentication process.

I have found below log on my domain controller, 1/9/2010,7:57:29 AM,Security,Success Audit,Logon/Logoff ,540,TMN\USERNAME,DC,"Successful Network Logon: User Name: USERNAME Domain: TMN Logon ID: (0x0,0xE55832A) Logon Type: 3 Logon Process: Kerberos Authentication Package: Kerberos Workstation Name: Logon GUID: {3362e1d8-b952-9b84-8911-df846e16c05e} Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 172.18.10.xxx Source Port: 0 From Information above and related articles on internet, i conclude that either of following, i) User logged into this server Or i) User accessed some share on this server though its authentication event triggered on domain controller where I have found this log. Correct me if I am wrong.