Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was checking my remote desktop event logs and an entry is confusing for me.

The event was a normal log on event with a username, but at details have a dash (-) for the source IP instead of a source IP address there.

The other events there have the correct source IP, so why does this entry not have an IP address for the source?

Event log screenshot

Here is the event log description
The text in the other window is the same except the IP.

share|improve this question
Might be useful if you post a screenshot of the event. Not anything to go on otherwise, TBH. – HopelessN00b Nov 8 '12 at 22:14
here is the schreenshot: – freshbox Nov 9 '12 at 18:13
Better, but can you post the information that's scrolled off the window in those two event log windows? – HopelessN00b Nov 9 '12 at 18:29
It would be helpful to see the Logon Type for both of these events, which is nearer the top of the Event details window. – joeqwerty Nov 10 '12 at 20:07
The caller PID is different on the event with the "-". That's a clue, I think. I suspect the "-" logon isn't an interactive logon coming in thru Winlogon. – Evan Anderson Nov 10 '12 at 20:16

This is because client authenticating via network logon. You need to change it to remote desktop connection

You can use this links for changing security settings

If you have time check this one also Windows Events for Remote Desktop logon failure

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.