[Samba] audit logging
rpenny at samba.org
Wed Jul 24 14:46:59 UTC 2019
On 24/07/2019 15:31, Edouard Guigné via samba wrote:
> I have set up audit logging and I find many entries of this type :
> ./auth/auth_log.c:760(log_authentication_event_human_readable) Auth:
> [SMB2,(null)] user [MYDOMAIN]\[MYWORKSTATION$] at [mar., 23 juil. 2019
> 07:49:43.486619 -03] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER]
> workstation [MYWORKSTATION] remote host [ipv4:10.x.x.x:49472] mapped
> to [MYDOMAIN]\[MYWORKSTATION$]. local host
> What does it mean ?
I would have thought that this was obvious, a computer has connected to
the domain, you are aware that a computer is just a user with an extra
objectclass and extra attributes ?
More information about the samba