A Standard windows server 2003 security question

We have a standard windows server 2003 with sql server 2005. I manage this
server. I never use my own credential to login this server. I always use
server-owner as a generic logon to login but I noticed under security of
event logs.

My name is always shown up with event ID 540, 576 and 538 and as
well as login time.
I just cannot find out what the connection it will be?

Any response will be appreciated.

Hello ginger,

What do you mean with 'server-owner' for login?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> We have a standard windows server 2003 with sql server 2005. I manage
> this server. I never use my own credential to login this server. I
> always use server-owner as a generic logon to login but I noticed
> under security of event logs.
>
> My name is always shown up with event ID 540, 576 and 538 and as well
> as login time. I just cannot find out what the connection it will be?
>
> Any response will be appreciated.
>

Hello ginger,

What do you mean with 'server-owner' for login?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> We have a standard windows server 2003 with sql server 2005. I manage
> this server. I never use my own credential to login this server. I
> always use server-owner as a generic logon to login but I noticed
> under security of event logs.
>
> My name is always shown up with event ID 540, 576 and 538 and as well
> as login time. I just cannot find out what the connection it will be?
>
> Any response will be appreciated.
>

I mean I never user my owner ID to login the server suchas Ginger. I always
use our generic network logon such as servergirl to logon the server. How can
I can see my name shown inn event security logs? this server is not domain
controller so I wonder there is some explanation about this?

"Meinolf Weber [MVP-DS]" wrote:

> Hello ginger,
>
> What do you mean with 'server-owner' for login?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
> > We have a standard windows server 2003 with sql server 2005. I manage
> > this server. I never use my own credential to login this server. I
> > always use server-owner as a generic logon to login but I noticed
> > under security of event logs.
> >
> > My name is always shown up with event ID 540, 576 and 538 and as well
> > as login time. I just cannot find out what the connection it will be?
> >
> > Any response will be appreciated.
> >
>
>
>

Hello ginger,

So this is another domain user account?

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> I mean I never user my owner ID to login the server suchas Ginger. I
> always use our generic network logon such as servergirl to logon the
> server. How can I can see my name shown inn event security logs? this
> server is not domain controller so I wonder there is some explanation
> about this?
>
> "Meinolf Weber [MVP-DS]" wrote:
>
>> Hello ginger,
>>
>> What do you mean with 'server-owner' for login?
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers
>> no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> We have a standard windows server 2003 with sql server 2005. I
>>> manage this server. I never use my own credential to login this
>>> server. I always use server-owner as a generic logon to login but I
>>> noticed under security of event logs.
>>>
>>> My name is always shown up with event ID 540, 576 and 538 and as
>>> well as login time. I just cannot find out what the connection it
>>> will be?
>>>
>>> Any response will be appreciated.
>>>

yes, both have domain admin rights.

"Meinolf Weber [MVP-DS]" wrote:

> Hello ginger,
>
> So this is another domain user account?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and confers
> no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>
> > I mean I never user my owner ID to login the server suchas Ginger. I
> > always use our generic network logon such as servergirl to logon the
> > server. How can I can see my name shown inn event security logs? this
> > server is not domain controller so I wonder there is some explanation
> > about this?
> >
> > "Meinolf Weber [MVP-DS]" wrote:
> >
> >> Hello ginger,
> >>
> >> What do you mean with 'server-owner' for login?
> >>
> >> Best regards
> >>
> >> Meinolf Weber
> >> Disclaimer: This posting is provided "AS IS" with no warranties, and
> >> confers
> >> no rights.
> >> ** Please do NOT email, only reply to Newsgroups
> >> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
> >>> We have a standard windows server 2003 with sql server 2005. I
> >>> manage this server. I never use my own credential to login this
> >>> server. I always use server-owner as a generic logon to login but I
> >>> noticed under security of event logs.
> >>>
> >>> My name is always shown up with event ID 540, 576 and 538 and as
> >>> well as login time. I just cannot find out what the connection it
> >>> will be?
> >>>
> >>> Any response will be appreciated.
> >>>
>
>
>

The username on the these events is the user name associated with the process
running on the computer that caused them to be generated. The 540
(Successful-Network-Logon Tells you that your account has bound to SQL) The
576 (Special Privs) happens when you are given your access. And the 538 is
the disconnect.
The username is probably the sAMAccount name from AD. You man be using the
userPrincipalName attribute, which is usually in network form Name@domain.

"ginger" wrote:

> We have a standard windows server 2003 with sql server 2005. I manage this
> server. I never use my own credential to login this server. I always use
> server-owner as a generic logon to login but I noticed under security of
> event logs.
>
> My name is always shown up with event ID 540, 576 and 538 and as
> well as login time.
> I just cannot find out what the connection it will be?
>
> Any response will be appreciated.
>