[Samba] audit logging

Rowland penny rpenny at samba.org
Wed Jul 24 14:46:59 UTC 2019


On 24/07/2019 15:31, Edouard Guigné via samba wrote:
> Hello,
>
> I have set up audit logging and I find many entries of this type :
>
> ./auth/auth_log.c:760(log_authentication_event_human_readable) Auth: 
> [SMB2,(null)] user [MYDOMAIN]\[MYWORKSTATION$] at [mar., 23 juil. 2019 
> 07:49:43.486619 -03] with [NTLMv2] status [NT_STATUS_NO_SUCH_USER] 
> workstation [MYWORKSTATION] remote host [ipv4:10.x.x.x:49472] mapped 
> to [MYDOMAIN]\[MYWORKSTATION$]. local host
>
> What does it mean ?
I would have thought that this was obvious, a computer has connected to 
the domain, you are aware that a computer is just a user with an extra 
objectclass and extra attributes ?

Rowland







More information about the samba mailing list