XP RDP event log 682 ?

From: BillyBob (billybobknob@hotmail.com)
Date: Sun Dec 12 2004 - 12:02:07 EST

• Next message: David Bouchard: "Laptop Considerations"
• Previous message: Jeffrey Denton: "Fwd: Article Announcement - Demystifying Penetration Testing"
• Next in thread: H Carvey: "Re: XP RDP event log 682 ?"
• Maybe reply: H Carvey: "Re: XP RDP event log 682 ?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

I have a few event log 682's (user has reconnected to a disconnected TS
session) on an XP machine at work that shows:
Session Name: Console
Client Name: Unknown
Client Address: Unknown

All other event log 682's show Session Name: RDP-Tcp# and they also
display the Client Name and Address.

Does this mean that these Unknown ones connected via Console were
connections made by someone who hacked the password and used a stealthed OS
?

Thanks,
Bill

• Next message: David Bouchard: "Laptop Considerations"
• Previous message: Jeffrey Denton: "Fwd: Article Announcement - Demystifying Penetration Testing"
• Next in thread: H Carvey: "Re: XP RDP event log 682 ?"
• Maybe reply: H Carvey: "Re: XP RDP event log 682 ?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:54:10 EDT