MSGINA is the Logon Process that was loaded.(GINA= Graphical Identification and Authentication)
KSecDD,RASMAN,Secondary Logon Service,LAN Manager Workstation Service,CHAP,DCOMSCM,Winlogon,Winlogon\MSGina are all standard logon processes you could see in the logs according to what mechanism is being used to authenticate. You will see those events at startup and during authentication attempts. MGGINA is the standard interactive logon interface you see when you press ctrl-alt-del, as implemented by msgina.dll. 3rd parties, such as RSA or PCAnywhere, can extend the functionality and present a different graphical interface to the user during the logon process. Winlogon and the standard GINA interact as follows: 1. Winlogon detects a Secure Action Sequence (SAS) event. (E.G. ctrl-alt-del) 2. Winlogon determines the system state when the SAS was detected. 3. Winlogon calls the appropriate GINA function. 4. The GINA function called performs the necessary operation. 5. The GINA passes a return value to Winlogon. If auditing is enabled, you should be able to see who knocked you off in the security logs. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Ramon Linan Sent: Friday, December 01, 2006 12:31 PM To: [email protected] Subject: [ActiveDir] security Hi, What is the meaning of this event, Does it means that MSGINA was trying to login into that machine where the event was found? I was connected to an XP pro using remote desktop and all the sudden it kicked me out saying someone else connected to it, how do I find out who was it? Thanks A trusted logon process has registered with the Local Security Authority. This logon process will be trusted to submit logon requests. Logon Process Name: Winlogon\MSGina For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Rezuma List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/[email protected]/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/[email protected]/
