See users logged into Windows 2000 server

Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Magueta

Thread Starter
Joined
Jan 16, 2005
Messages
20
I'm wondering if there's some way to tell if there is someone else logged onto a Windows 2000 server. In Unix there's the who command that tells you absolutely everyone who's logged onto the server. Is there something similar in Windows? Netstat is not an option because I use filesharing so there are way too many connections to get any idea if there's someone logged on that shouldn't be. I've gotten these weird authentication errors in my security event log and after some research it was clear that they could mean lots of things but some of the results mentioned that they got the same messages when they tried to logon to the Windows server using SSH and that they would get the errors but would logon anyway.
I'm not running SSH but the information has prompted me to make sure my system hasn't been compromised even though it is unlikely.
For those of you who are curious here are the events:
What do you think? If possible can this post also be linked to from the security forum? It may help.
Thanks

Joe

================================================================
EVENT # : 889
EVENT LOG : Security
EVENT TYPE : Audit Failure
SOURCE : Security
CATEGORY : Account Logon
EVENT ID : 681
USERNAME : NT AUTHORITY\SYSTEM
COMPUTER : <MyWorkstationName>
TIME : 2/7/2005 8:00:00 PM
MESSAGE : The logon to account: Administrator
by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
from workstation: <MyWorkstationName>
failed. The error code was: 3221225578

================================================================
EVENT # : 890
EVENT LOG : Security
EVENT TYPE : Audit Failure
SOURCE : Security
CATEGORY : Logon/Logoff
EVENT ID : 529
USERNAME : NT AUTHORITY\SYSTEM
COMPUTER : <MyWorkstationName>
TIME : 2/7/2005 8:00:00 PM
MESSAGE : Logon Failure:
Reason: Unknown user name or bad password
User Name: Administrator
Domain: <MyWorkstationName>
Logon Type: 4
Logon Process: Advapi
Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
Workstation Name: <MyWorkstationName>
================================================================
 
Status
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Top