Windows Security Log Events by ID: Event ID 528

Windows Security Log Events by ID

look up more events by Event ID or Category

Event ID

528

Title

Successful Logon

Type:

Example:

Randy's Comments:

Success

OS:

All versions

Category:

Logon/Logoff

Successful Logon:
User Name:administrator
Domain:ELM
Logon ID:(0x0,0x558DD)
Logon Type:2
Logon Process:User32
Authentication Package:Negotiate
Workstation Name:W2MS

Windows XP and Windows Server 2003 add:

Logon GUID:{d39697e4-34a9-b3e0-f30a-d2ba517eb4a2}

Windows Server 2003 adds these fields:

Caller User Name:-
Caller Domain:-
Caller Logon ID:-
Caller Process ID: -
Transited Services: -
Source Network Address:10.42.42.170
Source Port:3165

Event 528 is logged whenver an account logs on to the local computer, except for in the event of network logons (see event 540). Event 528 is logged whether the account used for logon is a local SAM account or a domain account.

For an explanation of the Logon Type field, see Logon Types.For an explanation of the Logon Process field, see event 515. For an explanation of the Authentication Package field, see event 514.

Logon GUID is not documented. It is unclear what purpose the Caller User Name, Caller Process ID, and Transited Services fields serve.

Source Network Address corresponds to the IP address of the Workstation Name. Source Port is the TCP port of the workstation and has dubious value.

Windows Security Log Events by ID

528

Successful Logon

Upcoming Webinars by Randy Franklin Smith

Additional Links