event log - Directory Service Access durch User ?

[rakli 13]

Hallo,

 

im event Log meines Server fand ich folgenden Eintrag, was hat der Benutzer Peter.Maier hier getan ?

 

 

event 565

Category: Directory Service Access

 

Object Open:

Object Server: Security Account Manager

Object Type: SAM_DOMAIN

Object Name: DC=domainname,DC=local

Handle ID: 128722544

Operation ID: {0,425226410}

Process ID: 492

Process Name: C:\WINDOWS\system32\lsass.exe

Primary User Name: servername$

Primary Domain: doaminname

Primary Logon ID: (0x0,0x3E7)

Client User Name: Peter.Maier

Client Domain: REFRATH01

Client Logon ID: (0x0,0x19587086)

Accesses: READ_CONTROL

ReadOtherParameters

CreateUser

GetLocalGroupMembership

 

Privileges: -

 

Properties:

---

domain

READ_CONTROL

ReadOtherParameters

CreateUser

GetLocalGroupMembership

Domain Password & Lockout Policies

lockOutObservationWindow

lockoutDuration

lockoutThreshold

maxPwdAge

minPwdAge

minPwdLength

pwdHistoryLength

pwdProperties

Other Domain Parameters (for use by SAM)

serverState

serverRole

modifiedCount

uASCompat

forceLogoff

domainReplica

oEMInformation

Domain Administer Server

 

Access Mask: 0

 

Gruss Rakli

[grizzly999 11]

Er hat was im AD gesucht/gelesen, was ja kein "problem" ist, da auth. Benutzer fast überall Leseberechtigungen haben

 

grizzly999