Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I was checking my remote desktop event logs and an entry is confusing for me.

The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source IP address there.

The other events there have the correct source IP, so why does this entry not have an IP address for the source?

Event log screenshot

Here is the event log description
English: http://pastebin.com/CtHC6xKD
The text in the other window is the same except the IP.

share|improve this question
Might be useful if you post a screenshot of the event. Not anything to go on otherwise, TBH. –  HopelessN00b Nov 8 '12 at 22:14
here is the schreenshot: img138.imageshack.us/img138/5029/servereventlog.png –  freshbox Nov 9 '12 at 18:13
Better, but can you post the information that's scrolled off the window in those two event log windows? –  HopelessN00b Nov 9 '12 at 18:29
It would be helpful to see the Logon Type for both of these events, which is nearer the top of the Event details window. –  joeqwerty Nov 10 '12 at 20:07
The caller PID is different on the event with the "-". That's a clue, I think. I suspect the "-" logon isn't an interactive logon coming in thru Winlogon. –  Evan Anderson Nov 10 '12 at 20:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.