Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was checking my remote desktop event logs and an entry is confusing for me.

The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source IP address there.

The other events there have the correct source IP, so why does this entry not have an IP address for the source?

Event log screenshot

Here is the event log description
English: http://pastebin.com/CtHC6xKD
The text in the other window is the same except the IP.

share|improve this question
Might be useful if you post a screenshot of the event. Not anything to go on otherwise, TBH. –  HopelessN00b Nov 8 '12 at 22:14
here is the schreenshot: img138.imageshack.us/img138/5029/servereventlog.png –  freshbox Nov 9 '12 at 18:13
Better, but can you post the information that's scrolled off the window in those two event log windows? –  HopelessN00b Nov 9 '12 at 18:29
It would be helpful to see the Logon Type for both of these events, which is nearer the top of the Event details window. –  joeqwerty Nov 10 '12 at 20:07
The caller PID is different on the event with the "-". That's a clue, I think. I suspect the "-" logon isn't an interactive logon coming in thru Winlogon. –  Evan Anderson Nov 10 '12 at 20:16

1 Answer 1

up vote 0 down vote accepted

Setup an Audit Policy using the Group Policy editor to successful logon and failures. Go to Run and type gpedit.msc

Local Computer Policy -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policies -> Audit logon events. Right click and select properties.

You can configure it according to your choices..

or u can go for a tool which will sort out your problem you can perform as many operation through a single software that will save your time also

Event Log analyzer

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.