Hi all,
When querying event logs with COMEventLogInputContextClassClass, the security eventlog gets flooded with logon/off eventid's. For example If querying the Application log on Machine X, it appears there is a logon/off put into the Security log for every record pulled out of the Application lo:
Successful Network Logon:
User Name: xxx
Domain: xxx
Logon ID: (0x0,0x82461027)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: yyy
User Logoff:
User Name: xxx
Domain: xxx
Logon ID: (0x0,0x82461027)
Logon Type: 3
I've tried a number of things but its driving me crazy! Any help would be much appreciated!
Dauhee.