26/04/2007	11:21:17 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x10BDFF)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
26/04/2007	11:21:17 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x10BDFF)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{cbfd949d-058a-9129-5513-f6d573566f0d}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 348
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	2482
"
26/04/2007	11:21:17 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {cbfd949d-058a-9129-5513-f6d573566f0d}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	348
 Source Network Address:	192.168.1.200
 Source Port:	2482
"
26/04/2007	10:25:40 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x1057B1)
 	Logon Type:	3
"
26/04/2007	10:25:40 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x1057B1)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{77af8b99-0f69-71be-bc1f-cced5c4f9586}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	10:25:40 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x1057B1)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
26/04/2007	09:59:44 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
26/04/2007	09:59:44 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2764
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	08:50:09 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xF568C)
 	Logon Type:	3
"
26/04/2007	08:50:09 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xF568C)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{484bac03-89b0-9343-4498-bf55602d221d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	08:50:09 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xF568C)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
26/04/2007	07:03:15 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE9C08)
 	Logon Type:	3
"
26/04/2007	07:03:15 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE9C08)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{b9a0cc7a-cd59-2569-2268-0f53e63033d8}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	07:03:15 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE9C08)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
26/04/2007	05:33:23 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE0202)
 	Logon Type:	3
"
26/04/2007	05:33:23 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE0202)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{d2c04fec-5b64-1e4a-2964-4eb70bae2a8f}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	05:33:23 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE0202)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
26/04/2007	03:50:33 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xD5286)
 	Logon Type:	3
"
26/04/2007	03:50:33 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xD5286)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{b9d294bd-a014-20ae-1702-78b1771feed3}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	03:50:33 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xD5286)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
26/04/2007	02:10:42 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC986D)
 	Logon Type:	3
"
26/04/2007	02:10:42 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC986D)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{37f491b3-01e5-54e2-eb8e-5eb868942e46}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	02:10:42 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC986D)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
26/04/2007	12:33:52 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xBB85D)
 	Logon Type:	3
"
26/04/2007	12:33:52 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xBB85D)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{3bf37a0a-6b9b-e9bb-af8c-fb728ab573cc}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
26/04/2007	12:33:52 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xBB85D)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:41:28 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xA49CB)
 	Logon Type:	3
"
25/04/2007	10:41:27 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xA49CB)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{d1f5352a-85b2-8ce0-5384-9078474d81fb}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:41:27 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xA49CB)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	08:55:27 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x960B9)
 	Logon Type:	3
"
25/04/2007	08:55:27 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x960B9)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{2889e33c-7c25-ab6b-8caa-a2e825a47390}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	08:55:27 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x960B9)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	07:09:38 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x87999)
 	Logon Type:	3
"
25/04/2007	07:09:38 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x87999)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{b328e24a-060a-ab00-c01f-b7d5cbf5fcae}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	07:09:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x87999)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	05:24:47 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x7898D)
 	Logon Type:	3
"
25/04/2007	05:24:47 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x7898D)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{4da8d7b5-497a-0fd8-9657-a76aee07c40f}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	05:24:47 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x7898D)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	03:26:45 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x66A17)
 	Logon Type:	3
"
25/04/2007	03:26:45 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x66A17)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{bab97b5b-4d23-776b-bcbe-d0388b168cb5}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	03:26:45 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x66A17)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	01:43:45 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x55D92)
 	Logon Type:	3
"
25/04/2007	01:43:45 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x55D92)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{2f42fe6d-9339-75d2-d523-a13d1a7cea6a}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	01:43:45 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x55D92)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:38:02 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0xC3D9)
 	Logon Type:	3
"
25/04/2007	12:37:58 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x47CE7)
 	Logon Type:	3
"
25/04/2007	12:37:48 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x47CE7)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	CAD3
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.143.9
 	Source Port:	0
"
25/04/2007	12:36:54 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x45564)
 	Logon Type:	3
"
25/04/2007	12:21:53 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x45564)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	CISCO3
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.215.59
 	Source Port:	0
"
25/04/2007	12:19:43 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:19:43 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:10:54 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3BF3F)
 	Logon Type:	3
"
25/04/2007	12:10:39 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x3BF3F)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	CAD3
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.143.9
 	Source Port:	0
"
25/04/2007	12:07:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 392
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:27 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:27 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:18 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC3D9)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:18 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:18 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:18 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:18 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:17 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:17 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:10 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:10 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:10 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:10 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:10 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	12:07:10 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	12:07:10 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
25/04/2007	12:06:09 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
25/04/2007	12:05:37 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x37B6B)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	HOD
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.138.138
 	Source Port:	0
"
25/04/2007	12:05:06 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x372DD)
 	Logon Type:	3
"
25/04/2007	12:04:59 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x372DD)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	ITS-5
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.138.138
 	Source Port:	0
"
25/04/2007	11:59:50 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:59:50 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:49:39 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34945)
 	Logon Type:	3
"
25/04/2007	11:49:39 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34945)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{d451390f-2b80-036b-c3e0-69ca1662e4ed}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:49:39 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34945)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:49:39 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34587)
 	Logon Type:	3
"
25/04/2007	11:49:39 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34587)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{7d8154de-3f3c-e419-11ad-07ef6b7f33fa}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:49:39 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34587)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:47:35 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:47:35 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 380
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:47:11 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:47:11 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:47:02 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC4AC)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:47:02 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:47:02 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:47:02 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:47:02 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:47:01 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:47:01 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:46:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:46:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:46:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:46:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:46:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	11:46:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	11:46:54 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
25/04/2007	11:45:51 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
25/04/2007	11:45:49 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3AD08)
 	Logon Type:	3
"
25/04/2007	11:45:49 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x42398)
 	Logon Type:	3
"
25/04/2007	11:45:19 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x42398)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	HOD
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.137.197
 	Source Port:	0
"
25/04/2007	11:44:49 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x41B1C)
 	Logon Type:	3
"
25/04/2007	11:44:41 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x41B1C)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	IBM-209ACFE1054
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.137.197
 	Source Port:	0
"
25/04/2007	10:56:09 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x3AD08)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	CISCO3
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.215.59
 	Source Port:	0
"
25/04/2007	10:29:53 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:29:53 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:22:17 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:22:17 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:19:41 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34937)
 	Logon Type:	3
"
25/04/2007	10:19:41 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34937)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{239292b0-7775-3e5e-38da-489c6aea3c08}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:19:41 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34937)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:19:41 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34578)
 	Logon Type:	3
"
25/04/2007	10:19:41 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34578)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{239292b0-7775-3e5e-38da-489c6aea3c08}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:19:41 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34578)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:17:36 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:17:36 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 456
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:17:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:17:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:17:04 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC2A1)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:17:03 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:17:03 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:17:03 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:17:03 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:17:03 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:17:03 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:16:56 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:16:56 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:16:56 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:16:56 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:16:56 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	10:16:56 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	10:16:56 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
25/04/2007	10:16:13 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
25/04/2007	10:16:12 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x37A0E)
 	Logon Type:	10
"
25/04/2007	10:16:06 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x37a0e)
"
25/04/2007	10:16:05 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x5988C)
 	Logon Type:	2
"
25/04/2007	10:15:35 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x8385E)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	HOD
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.138.138
 	Source Port:	0
"
25/04/2007	10:15:06 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x5988c)
"
25/04/2007	10:15:04 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x82C98)
 	Logon Type:	3
"
25/04/2007	10:14:57 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x82C98)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	ITS-5
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.138.138
 	Source Port:	0
"
25/04/2007	09:45:15 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:45:15 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1044
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:26:43 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x5988C)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
25/04/2007	09:26:43 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x5988C)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{fdebf97e-9afc-7726-3fc6-8657f0c944af}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
25/04/2007	09:26:43 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {fdebf97e-9afc-7726-3fc6-8657f0c944af}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
25/04/2007	09:24:26 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:24:26 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:17:49 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x37A0E)
 	Session Name:	RDP-Tcp#1
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
25/04/2007	09:14:35 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x37A0E)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
25/04/2007	09:14:35 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x37A0E)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{95512fb6-c179-7db8-6a14-9b09cb06e9db}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2364
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	46340
"
25/04/2007	09:14:35 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {95512fb6-c179-7db8-6a14-9b09cb06e9db}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	2364
 Source Network Address:	192.168.1.200
 Source Port:	46340
"
25/04/2007	09:14:14 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36707)
 	Logon Type:	3
"
25/04/2007	09:14:14 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36707)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{c2eb609c-c88c-4f19-8e7c-f1c4e49e8d70}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:14:14 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36707)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:14:14 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36349)
 	Logon Type:	3
"
25/04/2007	09:14:13 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36349)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{c2eb609c-c88c-4f19-8e7c-f1c4e49e8d70}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:14:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36349)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:13:23 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:13:23 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1044
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:12:29 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:12:29 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:12:09 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:12:09 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 396
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:45 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:11:45 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:36 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xBFA7)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:36 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:11:36 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:36 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:11:36 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:36 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:11:36 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:29 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:11:29 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:29 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:11:29 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:29 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
25/04/2007	09:11:29 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
25/04/2007	09:11:29 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
23/04/2007	03:00:43 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x375CE)
 	Logon Type:	3
"
23/04/2007	03:00:42 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x375CE)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	CAD3
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.143.9
 	Source Port:	0
"
23/04/2007	02:59:24 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:59:24 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:58:15 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:58:15 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:49:12 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34B51)
 	Logon Type:	3
"
23/04/2007	02:49:12 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34B51)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{18411a30-2ccc-785e-3392-e97785f39bb4}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:49:12 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34B51)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:49:12 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34792)
 	Logon Type:	3
"
23/04/2007	02:49:12 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34792)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{f7adb35d-a3d6-defc-3a9a-b78b90d7e0ec}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:49:12 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34792)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:47:07 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:47:07 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 388
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:40 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:46:40 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:31 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC398)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:46:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:46:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:46:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:24 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:46:24 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:24 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:46:24 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:24 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	02:46:24 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	02:46:24 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
23/04/2007	02:45:21 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
23/04/2007	02:05:09 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0xC645)
 	Logon Type:	3
"
23/04/2007	02:05:05 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x66495)
 	Logon Type:	3
"
23/04/2007	02:05:01 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x66495)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	CAD3
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.143.9
 	Source Port:	0
"
23/04/2007	01:59:14 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x658F0)
 	Logon Type:	3
"
23/04/2007	01:59:14 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x658F0)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{f611c02a-a824-0b86-c1a6-5bc2aed6270d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	01:59:14 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x658F0)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	12:28:15 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x58806)
 	Logon Type:	3
"
23/04/2007	12:28:14 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x58806)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{f012e9bf-3216-89af-2300-0cda4fc8c74f}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	12:28:14 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x58806)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	10:40:14 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x4A026)
 	Logon Type:	3
"
23/04/2007	10:40:14 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x4A026)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{f15bcab7-d909-d0ec-eec6-7abc137d7e3d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	10:40:14 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x4A026)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	10:10:29 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	10:10:29 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	09:57:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	09:57:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	09:52:53 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	09:52:53 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	09:01:19 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	09:01:19 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1076
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:59:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:59:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:49:00 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36ADE)
 	Logon Type:	3
"
23/04/2007	08:49:00 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36ADE)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{f270a325-1bc4-9043-cc04-b04204729b28}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:49:00 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36ADE)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:49:00 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3671F)
 	Logon Type:	3
"
23/04/2007	08:48:59 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3671F)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{ddf47339-149c-e24f-dcad-efa3e68970f3}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:48:59 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3671F)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:48:08 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:48:08 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1076
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:47:15 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:47:15 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 424
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:22 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC645)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
23/04/2007	08:46:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
23/04/2007	08:46:13 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
19/04/2007	08:27:52 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x15B41A)
 	Logon Type:	3
"
19/04/2007	08:27:52 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x15B41A)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{305df3ca-43c9-1a10-796a-e93b5fcba4e1}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
19/04/2007	08:27:52 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x15B41A)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
19/04/2007	06:38:53 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x14B60D)
 	Logon Type:	3
"
19/04/2007	06:38:52 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x14B60D)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{76d0476f-8811-773d-3394-70a032dd7e1e}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
19/04/2007	06:38:52 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x14B60D)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
19/04/2007	04:48:52 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x13BD02)
 	Logon Type:	3
"
19/04/2007	04:48:52 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x13BD02)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{5aa0f73b-bc28-a191-9e98-a39c16e15f1c}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
19/04/2007	04:48:52 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x13BD02)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
19/04/2007	03:05:51 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x12CD97)
 	Logon Type:	3
"
19/04/2007	03:05:51 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x12CD97)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{7064b214-5b18-d852-2135-05092c1ea4ef}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
19/04/2007	03:05:51 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x12CD97)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
19/04/2007	01:10:52 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x11C3B4)
 	Logon Type:	3
"
19/04/2007	01:10:51 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x11C3B4)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{2913a9ad-df6a-8961-78fb-91ffc9084b7d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
19/04/2007	01:10:51 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x11C3B4)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	11:15:51 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x10AFFB)
 	Logon Type:	3
"
18/04/2007	11:15:51 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x10AFFB)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{6f4f5806-d9d3-7828-734b-8a111f4a559a}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	11:15:51 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x10AFFB)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:35:51 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xFD1E7)
 	Logon Type:	3
"
18/04/2007	09:35:51 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xFD1E7)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{7db9f4ac-c20b-8dfb-1cd6-b9acca31f42d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:35:51 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xFD1E7)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	07:54:51 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xEF3D0)
 	Logon Type:	3
"
18/04/2007	07:54:51 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xEF3D0)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{09b732a8-7083-2a87-27ae-346c5df152b5}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	07:54:51 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xEF3D0)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	06:03:50 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE01E9)
 	Logon Type:	3
"
18/04/2007	06:03:50 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE01E9)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{4c5681b9-57a3-27fb-6e55-52b935ec0e29}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	06:03:50 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xE01E9)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	02:41:39 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xBF57D)
 	Logon Type:	3
"
18/04/2007	02:41:39 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xBF57D)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{66d5bb62-2ab6-61c2-0d31-5886c70ab52d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	02:41:39 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xBF57D)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	12:44:39 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xAAD47)
 	Logon Type:	3
"
18/04/2007	12:44:39 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xAAD47)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{3562753e-9ad7-1b17-b377-3b457dabbfc2}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	12:44:39 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xAAD47)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	12:39:14 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x6D3C0)
 	Session Name:	RDP-Tcp#6
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
18/04/2007	12:36:49 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xA6902)
 	Logon Type:	10
"
18/04/2007	12:36:49 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x6D3C0)
 	Session Name:	RDP-Tcp#6
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
18/04/2007	12:36:49 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xA6902)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
18/04/2007	12:36:49 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xA6902)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{96629869-29dd-61bd-96dd-b00052cdc67d}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 304
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	54051
"
18/04/2007	12:36:49 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {96629869-29dd-61bd-96dd-b00052cdc67d}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	304
 Source Network Address:	192.168.1.200
 Source Port:	54051
"
18/04/2007	12:36:14 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x36ca5)
"
18/04/2007	11:47:15 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x6D3C0)
 	Session Name:	RDP-Tcp#5
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
18/04/2007	11:46:59 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x6D3C0)
 	Session Name:	RDP-Tcp#5
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
18/04/2007	11:46:59 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x96E90)
 	Logon Type:	10
"
18/04/2007	11:46:59 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x96E90)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
18/04/2007	11:46:59 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x96E90)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{497023c4-e99d-74fe-7c59-533cb2d994b9}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1688
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	53141
"
18/04/2007	11:46:59 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {497023c4-e99d-74fe-7c59-533cb2d994b9}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	1688
 Source Network Address:	192.168.1.200
 Source Port:	53141
"
18/04/2007	11:28:23 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x6D3C0)
 	Session Name:	RDP-Tcp#4
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
18/04/2007	11:22:36 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x6D3C0)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
18/04/2007	11:22:36 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x6D3C0)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{9618e9a6-d0a7-61a3-7b6f-722f0debf86e}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2184
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	52427
"
18/04/2007	11:22:36 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {9618e9a6-d0a7-61a3-7b6f-722f0debf86e}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	2184
 Source Network Address:	192.168.1.200
 Source Port:	52427
"
18/04/2007	10:57:39 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x6909F)
 	Logon Type:	3
"
18/04/2007	10:57:38 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x6909F)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{dc95ada7-2a9e-44ec-143d-0f2364ce20b5}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	10:57:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x6909F)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:58:58 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0xC6E5)
 	Logon Type:	3
"
18/04/2007	09:58:58 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x5D897)
 	Logon Type:	3
"
18/04/2007	09:58:46 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x5D897)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	SERVERIBMACT
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.154.119
 	Source Port:	0
"
18/04/2007	09:58:39 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\ANONYMOUS LOGON	ISA	"User Logoff:
 	User Name:	ANONYMOUS LOGON
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x5D800)
 	Logon Type:	3
"
18/04/2007	09:58:21 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x5D800)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	SERVERIBMACT
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	168.187.154.119
 	Source Port:	0
"
18/04/2007	09:21:31 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x36CA5)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
18/04/2007	09:21:31 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x36CA5)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{ff724c0d-12b2-5336-e046-5d09c5cb8647}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
18/04/2007	09:21:31 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {ff724c0d-12b2-5336-e046-5d09c5cb8647}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
18/04/2007	09:21:21 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36532)
 	Logon Type:	3
"
18/04/2007	09:21:21 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36532)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{9d7c1aca-1272-cc20-37c5-ace4e1053682}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:21:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36532)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:21:21 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36174)
 	Logon Type:	3
"
18/04/2007	09:21:20 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36174)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{30dfac41-534e-7e00-bb00-7488b3a4e2e3}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:21:20 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x36174)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:19:15 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:19:15 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 396
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:48 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:18:48 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:39 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC6E5)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:18:38 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:18:38 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:18:38 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:18:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:18:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
18/04/2007	09:18:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
18/04/2007	09:18:31 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
17/04/2007	05:47:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	05:47:38 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	04:38:48 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	04:38:48 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1036
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	04:38:37 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	04:38:37 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	04:01:14 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#7
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
17/04/2007	04:01:13 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x104457)
 	Logon Type:	3
"
17/04/2007	04:01:13 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x104457)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{0b9c02cc-5a8e-9ce0-8711-b60b576baa72}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	04:01:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x104457)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	03:59:45 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xFFC05)
 	Logon Type:	10
"
17/04/2007	03:59:45 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#7
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
17/04/2007	03:59:44 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xFFC05)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	03:59:44 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xFFC05)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{31638f35-f252-8443-7937-73a7bfaccae3}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 3632
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	38247
"
17/04/2007	03:59:44 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {31638f35-f252-8443-7937-73a7bfaccae3}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	3632
 Source Network Address:	192.168.1.200
 Source Port:	38247
"
17/04/2007	03:32:41 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#6
 	Client Name:	EF25D
 	Client Address:	196.2.225.18"
17/04/2007	03:14:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	03:14:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	03:14:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	03:14:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2464
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	03:12:05 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#6
 	Client Name:	EF25D
 	Client Address:	196.2.225.18"
17/04/2007	03:10:09 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#5
 	Client Name:	EF25D
 	Client Address:	196.2.225.18"
17/04/2007	03:09:01 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	03:09:01 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	03:08:48 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xAA43A)
 	Logon Type:	7
"
17/04/2007	03:08:48 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xAA43A)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	03:08:48 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xAA43A)
 	Logon Type:	7
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{e9341415-77f6-949c-f516-f023453abc92}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
17/04/2007	03:08:48 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {e9341415-77f6-949c-f516-f023453abc92}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
17/04/2007	03:00:46 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#5
 	Client Name:	EF25D
 	Client Address:	196.2.225.18"
17/04/2007	03:00:09 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#4
 	Client Name:	EF25D
 	Client Address:	196.2.225.18"
17/04/2007	02:58:58 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:58:58 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:51:14 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#4
 	Client Name:	EF25D
 	Client Address:	196.2.225.18"
17/04/2007	02:50:07 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Session Name:	RDP-Tcp#1
 	Client Name:	EF25D
 	Client Address:	196.2.225.18"
17/04/2007	02:48:50 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:48:50 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:46:52 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	02:46:52 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x519F1)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{88ff2529-4bb8-b9b0-ae43-bf41efd09267}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 3092
 	Transited Services: -
 	Source Network Address:	196.2.225.18
 	Source Port:	2601
"
17/04/2007	02:46:52 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {88ff2529-4bb8-b9b0-ae43-bf41efd09267}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	3092
 Source Network Address:	196.2.225.18
 Source Port:	2601
"
17/04/2007	02:24:10 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x34DDC)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	02:24:10 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x34DDC)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{d1f786fc-1ce7-30b8-7f5a-415efa838982}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
17/04/2007	02:24:10 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {d1f786fc-1ce7-30b8-7f5a-415efa838982}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
17/04/2007	02:23:59 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34C02)
 	Logon Type:	3
"
17/04/2007	02:23:59 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34C02)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{78184392-313f-6270-d433-bc8a595e142d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:23:59 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34C02)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:23:59 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34844)
 	Logon Type:	3
"
17/04/2007	02:23:59 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34844)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{63b9417e-7dfb-2f8d-ee07-7adab42cd35a}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:23:59 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x34844)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:54 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:54 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 232
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:30 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:30 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:21 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC3A1)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:20 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:20 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:13 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:21:13 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:21:13 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
17/04/2007	02:20:32 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
17/04/2007	02:20:29 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x4b721)
"
17/04/2007	02:20:24 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xc1ed9)
"
17/04/2007	02:13:50 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	02:13:50 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1048
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	02:04:50 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xDAFAA)
 	Logon Type:	10
"
17/04/2007	02:04:50 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xC1ED9)
 	Session Name:	RDP-Tcp#6
 	Client Name:	EF25D
 	Client Address:	196.2.224.250"
17/04/2007	02:04:48 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xDAFAA)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	02:04:48 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xDAFAA)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{b2b95d0b-2f00-5053-a32b-9e28cc2c116f}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2724
 	Transited Services: -
 	Source Network Address:	196.2.224.250
 	Source Port:	2283
"
17/04/2007	02:04:48 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {b2b95d0b-2f00-5053-a32b-9e28cc2c116f}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	2724
 Source Network Address:	196.2.224.250
 Source Port:	2283
"
17/04/2007	01:55:30 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xC1ED9)
 	Session Name:	RDP-Tcp#5
 	Client Name:	DELL
 	Client Address:	192.168.1.202"
17/04/2007	01:54:57 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xD74A0)
 	Logon Type:	10
"
17/04/2007	01:54:57 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xC1ED9)
 	Session Name:	RDP-Tcp#5
 	Client Name:	DELL
 	Client Address:	192.168.1.202"
17/04/2007	01:54:57 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xD74A0)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	01:54:57 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xD74A0)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{bb74471c-042c-1d97-e4ba-e812bb40023f}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2452
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	1237
"
17/04/2007	01:54:57 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {bb74471c-042c-1d97-e4ba-e812bb40023f}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	2452
 Source Network Address:	192.168.1.202
 Source Port:	1237
"
17/04/2007	01:54:25 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xC1ED9)
 	Session Name:	RDP-Tcp#4
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
17/04/2007	01:53:05 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xC1ED9)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	01:53:05 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xC1ED9)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{252a6731-823c-a10e-8211-1dad0de4e8b4}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 3804
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	36167
"
17/04/2007	01:53:05 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {252a6731-823c-a10e-8211-1dad0de4e8b4}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	3804
 Source Network Address:	192.168.1.200
 Source Port:	36167
"
17/04/2007	01:51:59 	Security	Success Audit	Logon/Logoff 	538	WDP\dell	ISA	"User Logoff:
 	User Name:	dell
 	Domain:		WDP
 	Logon ID:		(0x0,0xBE52B)
 	Logon Type:	3
"
17/04/2007	01:51:47 	Security	Success Audit	Logon/Logoff 	540	WDP\dell	ISA	"Successful Network Logon:
 	User Name:	dell
 	Domain:		WDP
 	Logon ID:		(0x0,0xBE52B)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{ff398de2-96da-4ae5-a6a4-3ce3810300b7}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:51:47 	Security	Success Audit	Privilege Use 	576	WDP\dell	ISA	"Special privileges assigned to new logon:
 	User Name:	dell
 	Domain:		WDP
 	Logon ID:		(0x0,0xBE52B)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:45:22 	Security	Success Audit	Logon/Logoff 	538	WDP\dell	ISA	"User Logoff:
 	User Name:	dell
 	Domain:		WDP
 	Logon ID:		(0x0,0xB414C)
 	Logon Type:	3
"
17/04/2007	01:45:10 	Security	Success Audit	Logon/Logoff 	538	WDP\DELL$	ISA	"User Logoff:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4A80)
 	Logon Type:	3
"
17/04/2007	01:45:01 	Security	Success Audit	Logon/Logoff 	540	WDP\DELL$	ISA	"Successful Network Logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4A80)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{9af8d8f7-b194-e303-ec82-5c33b22fe3c5}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:45:01 	Security	Success Audit	Privilege Use 	576	WDP\DELL$	ISA	"Special privileges assigned to new logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4A80)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:45:00 	Security	Success Audit	Logon/Logoff 	538	WDP\DELL$	ISA	"User Logoff:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4A60)
 	Logon Type:	3
"
17/04/2007	01:45:00 	Security	Success Audit	Logon/Logoff 	540	WDP\DELL$	ISA	"Successful Network Logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4A60)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{cba9a27d-4c8c-8cc9-8c67-69cdb7fd7bd9}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:45:00 	Security	Success Audit	Privilege Use 	576	WDP\DELL$	ISA	"Special privileges assigned to new logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4A60)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:44:58 	Security	Success Audit	Logon/Logoff 	538	WDP\DELL$	ISA	"User Logoff:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB473B)
 	Logon Type:	3
"
17/04/2007	01:44:51 	Security	Success Audit	Logon/Logoff 	540	WDP\DELL$	ISA	"Successful Network Logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB473B)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{7a22ae1c-5945-2942-6fa2-b42e74c13180}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:44:51 	Security	Success Audit	Privilege Use 	576	WDP\DELL$	ISA	"Special privileges assigned to new logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB473B)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:44:49 	Security	Success Audit	Logon/Logoff 	538	WDP\DELL$	ISA	"User Logoff:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4489)
 	Logon Type:	3
"
17/04/2007	01:44:48 	Security	Success Audit	Logon/Logoff 	540	WDP\DELL$	ISA	"Successful Network Logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4489)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{20521849-ed54-5f9e-a71b-c37509b08f62}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:44:48 	Security	Success Audit	Privilege Use 	576	WDP\DELL$	ISA	"Special privileges assigned to new logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB4489)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:44:47 	Security	Success Audit	Logon/Logoff 	538	WDP\DELL$	ISA	"User Logoff:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB42EF)
 	Logon Type:	3
"
17/04/2007	01:44:36 	Security	Success Audit	Logon/Logoff 	540	WDP\DELL$	ISA	"Successful Network Logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB42EF)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{746cdf0b-7d20-1bb8-92b1-455c14dde14d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:44:36 	Security	Success Audit	Privilege Use 	576	WDP\DELL$	ISA	"Special privileges assigned to new logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB42EF)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:44:35 	Security	Success Audit	Logon/Logoff 	538	WDP\DELL$	ISA	"User Logoff:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB41A9)
 	Logon Type:	3
"
17/04/2007	01:44:29 	Security	Success Audit	Logon/Logoff 	540	WDP\DELL$	ISA	"Successful Network Logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB41A9)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{ed6a5214-be3e-0230-8e16-e6162eab587e}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:44:29 	Security	Success Audit	Privilege Use 	576	WDP\DELL$	ISA	"Special privileges assigned to new logon:
 	User Name:	DELL$
 	Domain:		WDP
 	Logon ID:		(0x0,0xB41A9)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:44:24 	Security	Success Audit	Logon/Logoff 	540	WDP\dell	ISA	"Successful Network Logon:
 	User Name:	dell
 	Domain:		WDP
 	Logon ID:		(0x0,0xB414C)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{fc560fb0-fbeb-1ece-4272-dd13f78101df}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.202
 	Source Port:	0
"
17/04/2007	01:44:24 	Security	Success Audit	Privilege Use 	576	WDP\dell	ISA	"Special privileges assigned to new logon:
 	User Name:	dell
 	Domain:		WDP
 	Logon ID:		(0x0,0xB414C)
 	Privileges:	SeChangeNotifyPrivilege"
17/04/2007	01:23:47 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3537f)
"
17/04/2007	01:14:00 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x4B721)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	01:14:00 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x4B721)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{13f833bd-7118-67c6-2b7e-03844df871e7}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
17/04/2007	01:14:00 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {13f833bd-7118-67c6-2b7e-03844df871e7}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
17/04/2007	01:08:26 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x366F0)
 	Logon Type:	3
"
17/04/2007	01:08:26 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x366F0)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{b4d3a4cd-a73e-8e9a-974b-920f27a0d5f6}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:08:26 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x366F0)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:08:26 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3633A)
 	Logon Type:	3
"
17/04/2007	01:08:26 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3633A)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{b4d3a4cd-a73e-8e9a-974b-920f27a0d5f6}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:08:26 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3633A)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:07:50 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3537F)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	01:07:50 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3537F)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{f049ce3b-3fe6-00a0-ddef-1530c485b46a}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2204
 	Transited Services: -
 	Source Network Address:	196.2.224.199
 	Source Port:	1948
"
17/04/2007	01:07:50 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {f049ce3b-3fe6-00a0-ddef-1530c485b46a}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	2204
 Source Network Address:	196.2.224.199
 Source Port:	1948
"
17/04/2007	01:06:42 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:06:42 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1048
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:06:22 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:06:22 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 296
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:06:01 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:06:01 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:55 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:05:55 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:49 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xC1A1)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:48 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:05:48 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:48 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:05:48 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:41 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:05:41 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:41 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:05:41 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:41 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	01:05:41 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	01:05:41 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
17/04/2007	01:05:19 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
17/04/2007	01:05:17 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3f201)
"
17/04/2007	01:05:14 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x31bc4)
"
17/04/2007	12:48:58 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:48:58 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:47:29 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:47:29 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:46:03 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:46:03 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:42:49 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3F201)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	12:42:49 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3F201)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{685d2838-c9df-3225-a6ff-6c4e7a59dd55}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
17/04/2007	12:42:49 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {685d2838-c9df-3225-a6ff-6c4e7a59dd55}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
17/04/2007	12:42:24 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x32E98)
 	Logon Type:	3
"
17/04/2007	12:42:24 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x32E98)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{cab95d8f-d02a-7a36-9c9c-5783e6b17e3b}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:42:24 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x32E98)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:42:24 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x32AE2)
 	Logon Type:	3
"
17/04/2007	12:42:24 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x32AE2)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{cab95d8f-d02a-7a36-9c9c-5783e6b17e3b}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:42:24 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x32AE2)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:41:31 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x31BC4)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	12:41:31 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x31BC4)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{2960f62a-86ad-4812-2c51-2a860cb410f2}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2088
 	Transited Services: -
 	Source Network Address:	196.2.224.199
 	Source Port:	1765
"
17/04/2007	12:41:31 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {2960f62a-86ad-4812-2c51-2a860cb410f2}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	2088
 Source Network Address:	196.2.224.199
 Source Port:	1765
"
17/04/2007	12:39:59 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:39:59 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:52 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:39:52 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:46 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xBD52)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:45 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:39:45 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:45 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:39:45 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:39:38 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:39:38 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:38 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:39:38 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:39:38 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
17/04/2007	12:39:17 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
17/04/2007	12:39:09 	Security	Success Audit	Logon/Logoff 	551	WDP\Administrator	ISA	"User initiated logoff:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x294f4)
"
17/04/2007	12:39:09 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x40d83)
"
17/04/2007	12:39:04 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x12821)
"
17/04/2007	12:36:31 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:36:31 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:29:32 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x5CB60)
 	Logon Type:	10
"
17/04/2007	12:29:32 	Security	Success Audit	Logon/Logoff 	682	NT AUTHORITY\SYSTEM	ISA	"Session reconnected to winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x40D83)
 	Session Name:	RDP-Tcp#5
 	Client Name:	EF25D
 	Client Address:	196.2.224.199"
17/04/2007	12:29:29 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x5CB60)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	12:29:29 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x5CB60)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{25dd40b4-d0a1-0c9c-c004-a7c9fb3fc207}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 3928
 	Transited Services: -
 	Source Network Address:	196.2.224.199
 	Source Port:	1704
"
17/04/2007	12:29:29 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {25dd40b4-d0a1-0c9c-c004-a7c9fb3fc207}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	3928
 Source Network Address:	196.2.224.199
 Source Port:	1704
"
17/04/2007	12:19:04 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x40D83)
 	Session Name:	RDP-Tcp#3
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
17/04/2007	12:18:06 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x40D83)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	12:18:06 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x40D83)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{2e1de531-3f4d-da61-f714-3fe0445bfba2}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 2436
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	33985
"
17/04/2007	12:18:06 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {2e1de531-3f4d-da61-f714-3fe0445bfba2}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	2436
 Source Network Address:	192.168.1.200
 Source Port:	33985
"
17/04/2007	12:16:46 	Security	Success Audit	Logon/Logoff 	683	NT AUTHORITY\SYSTEM	ISA	"Session disconnected from winstation:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x294F4)
 	Session Name:	RDP-Tcp#2
 	Client Name:	SERVER
 	Client Address:	192.168.1.200"
17/04/2007	12:16:12 	Security	Success Audit	Privilege Use 	576	WDP\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x294F4)
 	Privileges:	SeAuditPrivilege
			SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	12:16:12 	Security	Success Audit	Logon/Logoff 	528	WDP\Administrator	ISA	"Successful Logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x294F4)
 	Logon Type:	10
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{b15bdf4d-26dc-5537-2fa9-2cfdb82b758b}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 368
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	33957
"
17/04/2007	12:16:12 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	WDP
 	Target Logon GUID: {b15bdf4d-26dc-5537-2fa9-2cfdb82b758b}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	368
 Source Network Address:	192.168.1.200
 Source Port:	33957
"
17/04/2007	12:15:03 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	12:15:03 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1080
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	12:14:29 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x265E9)
 	Logon Type:	7
"
17/04/2007	12:14:29 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x265E9)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	12:14:29 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x265E9)
 	Logon Type:	7
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{6a88f23f-2b08-8a35-fc91-f4e8c815a42d}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
17/04/2007	12:14:29 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {6a88f23f-2b08-8a35-fc91-f4e8c815a42d}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
17/04/2007	11:49:13 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x12821)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	11:49:13 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x12821)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{fd8bf3fb-9867-bb5c-8446-ce75bf39287d}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
17/04/2007	11:49:13 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {fd8bf3fb-9867-bb5c-8446-ce75bf39287d}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
17/04/2007	11:47:36 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:47:36 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:44:36 	Security	Success Audit	Logon/Logoff 	538	WDP\Administrator	ISA	"User Logoff:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x12427)
 	Logon Type:	3
"
17/04/2007	11:44:26 	Security	Success Audit	Logon/Logoff 	538	WDP\Administrator	ISA	"User Logoff:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x12462)
 	Logon Type:	3
"
17/04/2007	11:44:26 	Security	Success Audit	Logon/Logoff 	540	WDP\Administrator	ISA	"Successful Network Logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x12462)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	SERVER
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:44:26 	Security	Success Audit	Privilege Use 	576	WDP\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x12462)
 	Privileges:	SeAuditPrivilege
			SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	11:44:26 	Security	Success Audit	Logon/Logoff 	540	WDP\Administrator	ISA	"Successful Network Logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x12427)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{2d3fd02d-1406-1999-21bb-fae4cd575f92}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	0
"
17/04/2007	11:44:26 	Security	Success Audit	Privilege Use 	576	WDP\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x12427)
 	Privileges:	SeAuditPrivilege
			SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	11:38:37 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:38:37 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1080
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:37:56 	Security	Success Audit	Logon/Logoff 	538	WDP\Administrator	ISA	"User Logoff:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0xD570)
 	Logon Type:	3
"
17/04/2007	11:37:48 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:37:48 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:37:45 	Security	Success Audit	Logon/Logoff 	538	WDP\Administrator	ISA	"User Logoff:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0xD5B1)
 	Logon Type:	3
"
17/04/2007	11:37:45 	Security	Success Audit	Logon/Logoff 	540	WDP\Administrator	ISA	"Successful Network Logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0xD5B1)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	SERVER
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:37:45 	Security	Success Audit	Privilege Use 	576	WDP\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0xD5B1)
 	Privileges:	SeAuditPrivilege
			SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	11:37:45 	Security	Success Audit	Logon/Logoff 	540	WDP\Administrator	ISA	"Successful Network Logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0xD570)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{1342d721-b218-9576-6ce1-0d067ebc175d}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	0
"
17/04/2007	11:37:45 	Security	Success Audit	Privilege Use 	576	WDP\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0xD570)
 	Privileges:	SeAuditPrivilege
			SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
17/04/2007	11:37:18 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xCE62)
 	Logon Type:	3
"
17/04/2007	11:37:18 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xCE62)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{d6310158-307d-1a93-0dcb-f636f338b002}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:37:18 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xCE62)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:37:18 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC73D)
 	Logon Type:	3
"
17/04/2007	11:37:17 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC73D)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{d6310158-307d-1a93-0dcb-f636f338b002}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:37:17 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC73D)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:36:54 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xB8E8)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:36:53 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:36:53 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:36:53 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:36:53 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:36:46 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:36:46 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:36:46 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:36:46 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:36:46 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
17/04/2007	11:36:46 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
17/04/2007	11:36:46 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	03:32:38 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
16/04/2007	03:32:36 	Security	Success Audit	Logon/Logoff 	551	WDP\maamoun	ISA	"User initiated logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xdf02)
"
16/04/2007	03:32:33 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x45A40)
 	Logon Type:	7
"
16/04/2007	03:32:33 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	-
 	Domain:		-
 	Logon ID:		(0x0,0x45A40)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	03:32:33 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x45A40)
 	Logon Type:	7
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{c8429960-8d77-c5ff-3306-0689b426fb72}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
16/04/2007	03:32:33 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {c8429960-8d77-c5ff-3306-0689b426fb72}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
16/04/2007	03:23:23 	Security	Success Audit	Logon/Logoff 	538	WDP\maamoun	ISA	"User Logoff:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3C586)
 	Logon Type:	7
"
16/04/2007	03:23:23 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3C586)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	03:23:23 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0x3C586)
 	Logon Type:	7
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{cc8f4fbe-c4e2-0cf5-b1ac-23506b438286}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
16/04/2007	03:23:23 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {cc8f4fbe-c4e2-0cf5-b1ac-23506b438286}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
16/04/2007	02:59:34 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	02:59:34 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:49:36 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:49:36 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1028
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:47:59 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:47:59 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:47:59 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:47:59 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1028
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:47:59 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:47:59 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1028
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:47:24 	Security	Success Audit	Logon/Logoff 	538	WDP\Administrator	ISA	"User Logoff:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x3050D)
 	Logon Type:	3
"
16/04/2007	01:47:14 	Security	Success Audit	Logon/Logoff 	538	WDP\Administrator	ISA	"User Logoff:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x3054C)
 	Logon Type:	3
"
16/04/2007	01:47:14 	Security	Success Audit	Logon/Logoff 	540	WDP\Administrator	ISA	"Successful Network Logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x3054C)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	SERVER
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:47:14 	Security	Success Audit	Privilege Use 	576	WDP\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x3054C)
 	Privileges:	SeAuditPrivilege
			SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	01:47:14 	Security	Success Audit	Logon/Logoff 	540	WDP\Administrator	ISA	"Successful Network Logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x3050D)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{f14911e5-38e5-d9f4-ae01-50f9660ffff1}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	192.168.1.200
 	Source Port:	0
"
16/04/2007	01:47:14 	Security	Success Audit	Privilege Use 	576	WDP\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		WDP
 	Logon ID:		(0x0,0x3050D)
 	Privileges:	SeAuditPrivilege
			SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	01:41:16 	Security	Success Audit	Privilege Use 	576	WDP\maamoun	ISA	"Special privileges assigned to new logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xDF02)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	01:41:16 	Security	Success Audit	Logon/Logoff 	528	WDP\maamoun	ISA	"Successful Logon:
 	User Name:	maamoun
 	Domain:		WDP
 	Logon ID:		(0x0,0xDF02)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	{1c0e9647-d9df-2386-0b52-6467463c3356}
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 580
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
16/04/2007	01:41:16 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	maamoun
 	Target Domain:	WDP
 	Target Logon GUID: {1c0e9647-d9df-2386-0b52-6467463c3356}

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	580
 Source Network Address:	127.0.0.1
 Source Port:	0
"
16/04/2007	01:40:42 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xCC7B)
 	Logon Type:	3
"
16/04/2007	01:40:42 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xCC7B)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{4d46a317-7e09-51ba-8763-4dc90dce763a}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:42 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xCC7B)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:40:42 	Security	Success Audit	Logon/Logoff 	538	NT AUTHORITY\SYSTEM	ISA	"User Logoff:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC8BD)
 	Logon Type:	3
"
16/04/2007	01:40:41 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\SYSTEM	ISA	"Successful Network Logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC8BD)
 	Logon Type:	3
 	Logon Process:	Kerberos
 	Authentication Package:	Kerberos
 	Workstation Name:	
 	Logon GUID:	{4d46a317-7e09-51ba-8763-4dc90dce763a}
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:41 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\SYSTEM	ISA	"Special privileges assigned to new logon:
 	User Name:	ISA$
 	Domain:		WDP
 	Logon ID:		(0x0,0xC8BD)
 	Privileges:	SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:40:18 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xBB71)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:18 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:40:18 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:17 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:40:17 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:10 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:40:10 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:10 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:40:10 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:10 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:40:10 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WDP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 624
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:40:10 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WDP
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	01:39:41 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
16/04/2007	01:39:39 	Security	Success Audit	Logon/Logoff 	551	ISA\Administrator	ISA	"User initiated logoff:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0xaa53)
"
16/04/2007	01:39:31 	Security	Success Audit	Policy Change 	612	ISA\Administrator	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	Administrator
 	  Domain Name:	ISA
 	  Logon ID:	(0x0,0xAA53)"
16/04/2007	01:39:31 	Security	Success Audit	Policy Change 	612	ISA\Administrator	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	Administrator
 	  Domain Name:	ISA
 	  Logon ID:	(0x0,0xAA53)"
16/04/2007	01:39:31 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WORKGROUP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	WDP.KW
 	Target Logon GUID: -

 Target Server Name:	server.wdp.kw
 Target Server Info:	LDAP/server.wdp.kw
 Caller Process ID:	604
 Source Network Address:	-
 Source Port:	-
"
16/04/2007	01:39:31 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WORKGROUP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	WDP.KW
 	Target Logon GUID: {3c42e7bd-3869-fede-3dc5-7badf1780e5b}

 Target Server Name:	server.wdp.kw
 Target Server Info:	ldap/server.wdp.kw
 Caller Process ID:	604
 Source Network Address:	-
 Source Port:	-
"
16/04/2007	01:39:31 	Security	Success Audit	Logon/Logoff 	552	ISA\Administrator	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0xAA53)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	WDP.KW
 	Target Logon GUID: {4d5fa4b4-1918-9127-f3ac-a8e27ec7f9ee}

 Target Server Name:	server.wdp.kw
 Target Server Info:	cifs/server.wdp.kw
 Caller Process ID:	604
 Source Network Address:	-
 Source Port:	-
"
16/04/2007	01:39:25 	Security	Success Audit	Logon/Logoff 	552	ISA\Administrator	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0xAA53)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	WDP.KW
 	Target Logon GUID: {467d35bd-c888-3bfd-3535-1ad6d0c9e5c1}

 Target Server Name:	server.wdp.kw
 Target Server Info:	cifs/server.wdp.kw
 Caller Process ID:	604
 Source Network Address:	-
 Source Port:	-
"
16/04/2007	01:39:00 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:39:00 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1084
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:31:01 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:31:01 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1084
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:29:58 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x13895)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:29:57 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:29:57 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 592
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:29:56 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:29:56 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 592
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:29:02 	Security	Success Audit	Privilege Use 	576	ISA\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0xAA53)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	01:29:02 	Security	Success Audit	Logon/Logoff 	528	ISA\Administrator	ISA	"Successful Logon:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0xAA53)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 548
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
16/04/2007	01:29:02 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WORKGROUP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	ISA
 	Target Logon GUID: -

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	548
 Source Network Address:	127.0.0.1
 Source Port:	0
"
16/04/2007	01:29:02 	Security	Success Audit	Account Logon 	680	ISA\Administrator	ISA	"Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	Administrator
 Source Workstation:	ISA
 Error Code:	0x0
"
16/04/2007	01:28:46 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:28:46 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 592
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:28:46 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:28:46 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 592
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:28:46 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:28:46 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 592
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:28:46 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WORKGROUP
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	01:28:04 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
16/04/2007	01:28:01 	Security	Success Audit	Logon/Logoff 	551	ISA\Administrator	ISA	"User initiated logoff:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0x99eb)
"
16/04/2007	01:24:15 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:24:15 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 956
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:24:04 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0x18616)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:24:03 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:24:03 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 528
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:24:03 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:24:03 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 528
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:23:16 	Security	Success Audit	Privilege Use 	576	ISA\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0x99EB)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	01:23:16 	Security	Success Audit	Logon/Logoff 	528	ISA\Administrator	ISA	"Successful Logon:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0x99EB)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 484
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
16/04/2007	01:23:16 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WORKGROUP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	ISA
 	Target Logon GUID: -

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	484
 Source Network Address:	127.0.0.1
 Source Port:	0
"
16/04/2007	01:23:16 	Security	Success Audit	Account Logon 	680	ISA\Administrator	ISA	"Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	Administrator
 Source Workstation:	ISA
 Error Code:	0x0
"
16/04/2007	01:22:57 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:22:57 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 528
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:22:57 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:22:57 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 528
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:22:57 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:22:57 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 528
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:22:57 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WORKGROUP
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	01:22:15 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
16/04/2007	01:22:01 	Security	Success Audit	Logon/Logoff 	551	ISA\Administrator	ISA	"User initiated logoff:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0x15c70)
"
16/04/2007	01:19:40 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:19:40 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1024
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:18:08 	Security	Success Audit	Privilege Use 	576	ISA\Administrator	ISA	"Special privileges assigned to new logon:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0x15C70)
 	Privileges:	SeChangeNotifyPrivilege
			SeBackupPrivilege
			SeRestorePrivilege
			SeDebugPrivilege"
16/04/2007	01:18:08 	Security	Success Audit	Logon/Logoff 	528	ISA\Administrator	ISA	"Successful Logon:
 	User Name:	Administrator
 	Domain:		ISA
 	Logon ID:		(0x0,0x15C70)
 	Logon Type:	2
 	Logon Process:	User32  
 	Authentication Package:	Negotiate
 	Workstation Name:	ISA
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 496
 	Transited Services: -
 	Source Network Address:	127.0.0.1
 	Source Port:	0
"
16/04/2007	01:18:08 	Security	Success Audit	Logon/Logoff 	552	NT AUTHORITY\SYSTEM	ISA	"Logon attempt using explicit credentials:
 Logged on user:
 	User Name:	ISA$
 	Domain:		WORKGROUP
 	Logon ID:		(0x0,0x3E7)
 	Logon GUID:	-
 User whose credentials were used:
 	Target User Name:	Administrator
 	Target Domain:	ISA
 	Target Logon GUID: -

 Target Server Name:	localhost
 Target Server Info:	localhost
 Caller Process ID:	496
 Source Network Address:	127.0.0.1
 Source Port:	0
"
16/04/2007	01:18:08 	Security	Success Audit	Account Logon 	680	ISA\Administrator	ISA	"Logon attempt by:	MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 Logon account:	Administrator
 Source Workstation:	ISA
 Error Code:	0x0
"
16/04/2007	01:08:17 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:08:17 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 1024
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:07:44 	Security	Success Audit	Logon/Logoff 	540	NT AUTHORITY\ANONYMOUS LOGON	ISA	"Successful Network Logon:
 	User Name:	
 	Domain:		
 	Logon ID:		(0x0,0xA55D)
 	Logon Type:	3
 	Logon Process:	NtLmSsp 
 	Authentication Package:	NTLM
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	-
 	Caller Domain:	-
 	Caller Logon ID:	-
 	Caller Process ID: -
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:07:43 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:07:43 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 540
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:07:43 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:07:43 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 540
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:06:33 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:06:33 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	ISA	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 540
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:06:33 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:06:33 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 540
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:06:33 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	ISA	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:06:33 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	ISA	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	ISA$
 	Caller Domain:	WORKGROUP
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 540
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	01:06:33 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	ISA	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	ISA$
 	  Domain Name:	WORKGROUP
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	01:05:51 	SECURITY	Success Audit	System Event 	513	N/A	ISA	Windows is shutting down. All logon sessions will be terminated by this shutdown.
16/04/2007	01:01:34 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	MACHINENAME	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	01:01:34 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	MACHINENAME	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	MACHINENAME$
 	Caller Domain:	
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 296
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	12:58:47 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	MACHINENAME	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	12:58:47 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	MACHINENAME	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	MACHINENAME$
 	Caller Domain:	
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 296
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	12:57:30 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	MACHINENAME	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	MACHINENAME$
 	  Domain Name:	
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	12:56:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	MACHINENAME	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	12:56:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	MACHINENAME	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	MACHINENAME$
 	Caller Domain:	
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 296
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	12:56:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\NETWORK SERVICE	MACHINENAME	"Special privileges assigned to new logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	12:56:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\NETWORK SERVICE	MACHINENAME	"Successful Logon:
 	User Name:	NETWORK SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E4)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	MACHINENAME$
 	Caller Domain:	
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 296
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	12:56:21 	Security	Success Audit	Privilege Use 	576	NT AUTHORITY\LOCAL SERVICE	MACHINENAME	"Special privileges assigned to new logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Privileges:	SeAuditPrivilege
			SeAssignPrimaryTokenPrivilege
			SeChangeNotifyPrivilege"
16/04/2007	12:56:21 	Security	Success Audit	Logon/Logoff 	528	NT AUTHORITY\LOCAL SERVICE	MACHINENAME	"Successful Logon:
 	User Name:	LOCAL SERVICE
 	Domain:		NT AUTHORITY
 	Logon ID:		(0x0,0x3E5)
 	Logon Type:	5
 	Logon Process:	Advapi  
 	Authentication Package:	Negotiate
 	Workstation Name:	
 	Logon GUID:	-
 	Caller User Name:	MACHINENAME$
 	Caller Domain:	
 	Caller Logon ID:	(0x0,0x3E7)
 	Caller Process ID: 296
 	Transited Services: -
 	Source Network Address:	-
 	Source Port:	-
"
16/04/2007	12:56:08 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	MACHINENAME	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	MACHINENAME$
 	  Domain Name:	
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	12:56:05 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	MACHINENAME	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	MACHINENAME$
 	  Domain Name:	
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	03:46:23 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	MACHINENAME	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    +	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    +	    -	Account Logon

 Changed By:
 	  User Name:	MACHINENAME$
 	  Domain Name:	
 	  Logon ID:	(0x0,0x3E7)"
16/04/2007	03:45:18 	Security	Success Audit	Policy Change 	612	NT AUTHORITY\SYSTEM	MACHINENAME	"Audit Policy Change:
 New Policy:
 	Success	Failure
 	    -	    -	Logon/Logoff
 	    -	    -	Object Access
 	    -	    -	Privilege Use
 	    -	    -	Account Management
 	    -	    -	Policy Change
 	    -	    -	System
 	    -	    -	Detailed Tracking
 	    -	    -	Directory Service Access
 	    -	    -	Account Logon

 Changed By:
 	  User Name:	MACHINENAME$
 	  Domain Name:	
 	  Logon ID:	(0x0,0x3E7)"
