Event ID 540

[vic]

I found the following in my event viewer in the Success
Audit Properties:

Date 9/6/2004
Source: Security
Time 10:03
Category: logon/Logoff
Type: Success
Event ID: 540
User: DOMAINNAME\bsmith
Computer: NAMEOFSERVER

Successful Network Logon:
UserName: bsmith
Domain: DOMAINNAME
Logon ID: (0x0,0x2 etc)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:

bsmith has admin rights. The office was closed on
9/6/2004 as it was Labor Day and no one was here.

This is from a Windows 2000 server. Is there anything to
worry about? What does this mean?
Thanks for any help.

 

[Guest]

I also have SP4 on the server. And, a few seconds later I
got a Event ID 538 with the bsmith username, DOMAIN name,
logon id and Logon Type 3.

I appreciate any insight on these events.

 

[Steven L Umbach]

A user can still generate a logon even if he is not present. Reasons could be a user
not logging off or the use of credentials for a service, Sheduled Task, etc. ---
Steve