Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I experienced a strange event when my RD connection got disconnected from my server, and wasn't able to reconnect a couple of minutes.

When I was reconnected PG admin was closed, and I didn't close it (was open before I was dropped).. I got very worried and want to check whether it was my active hosting support doing smth or I got hacked.

share|improve this question
    
possible duplicate of: serverfault.com/questions/121399/… –  quanta Sep 19 '11 at 10:19
    
in my security log all event ids are > 4600, what can I be doing wrong , if ID has to be 528 I get no such ids in security log –  Valentin Kuzub Sep 19 '11 at 10:52
    
Check the system kog first. Did it reboot? –  Zoredache Sep 19 '11 at 15:27
    
@quanta, those steps will not work for this user since that question dealt with Windows Server 2003. The event IDs have changed since Vista and Windows Server 2008. –  pk. Sep 19 '11 at 16:22
add comment

3 Answers 3

up vote 2 down vote accepted

Look for the following event IDs:

  • 4624 An account was successfully logged on (LogonType=10)
  • 4625 An account failed to log on
  • 4634 An account was logged off (LogonType=10)
  • 4647 User initiated logoff
  • 4778 A session was reconnected to a Window Station
  • 4779 A session was disconnected from a Window Station
share|improve this answer
add comment

You should call your host. That's the quickest way to determine if they are doing maintenance. If they are not, then you want to look in the system log for logon events around that time. You can filter the event viewer for that time period and look one event at a time for anything suspicious.

share|improve this answer
add comment

Actually I contacted support and they told me it was some kind of their Hyper V reboot. This was a VPS server. System was showing runtime equal to time since that disconnect.

pk. your ids are much better then that 528, so Ill mark it as answer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.