3

I experienced a strange event when my RD connection got disconnected from my server, and wasn't able to reconnect a couple of minutes.

When I was reconnected PG admin was closed, and I didn't close it (was open before I was dropped).. I got very worried and want to check whether it was my active hosting support doing smth or I got hacked.

4
  • possible duplicate of: serverfault.com/questions/121399/…
    – quanta
    Sep 19, 2011 at 10:19
  • in my security log all event ids are > 4600, what can I be doing wrong , if ID has to be 528 I get no such ids in security log Sep 19, 2011 at 10:52
  • Check the system kog first. Did it reboot?
    – Zoredache
    Sep 19, 2011 at 15:27
  • @quanta, those steps will not work for this user since that question dealt with Windows Server 2003. The event IDs have changed since Vista and Windows Server 2008.
    – pk.
    Sep 19, 2011 at 16:22

3 Answers 3

3

Look for the following event IDs:

  • 4624 An account was successfully logged on (LogonType=10)
  • 4625 An account failed to log on
  • 4634 An account was logged off (LogonType=10)
  • 4647 User initiated logoff
  • 4778 A session was reconnected to a Window Station
  • 4779 A session was disconnected from a Window Station
1
  • Additional info: look for these events in the Security log.
    – kevin
    Jun 23, 2017 at 16:41
2

You should call your host. That's the quickest way to determine if they are doing maintenance. If they are not, then you want to look in the system log for logon events around that time. You can filter the event viewer for that time period and look one event at a time for anything suspicious.

0

Actually I contacted support and they told me it was some kind of their Hyper V reboot. This was a VPS server. System was showing runtime equal to time since that disconnect.

pk. your ids are much better then that 528, so Ill mark it as answer.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .