what does this Transitive Network Logon entry in NetLogon.Log mean?

Question

_{Tuesday, February 28, 2012 11:11 PM}

02/28 15:32:10 [LOGON] Domain: SamLogon: Transitive Network logon of workstation\Administrator from workstation (via workstation) Entered
02/28 15:32:10 [LOGON] Domain: SamLogon: Transitive Network logon of workstation\Administrator from workstation (via workstation) Returns 0xC000006A

I've seen a few entries like this in my NetLogon.Log...but this seems mysterious to me? What kind of action is causing a transitive network logon from a workstation to itself? Could this be generated by a user trying to remotely logon to 'workstation' using some sort of remote access client installed on 'workstation'?

All replies (7)

_{Thursday, March 1, 2012 5:01 AM ✅Answered | 1 vote}

Hi AJM-B,

Thanks for your post.

The Transitive Network logon means that the logon credential has been forwarded to the computer which has captured the log files. It is commonly referred to as pass-through authentication, and via indicated the source of the authentication.

For detailed information about net logon debug, please refer to the following article:

Maintaining and Monitoring Account Lockout
http://technet.microsoft.com/en-us/library/cc776964(v=ws.10).aspx

Track Net Logon Debug
http://download.microsoft.com/download/a/8/7/a87526d3-b794-4d93-865a-07c9c2b076e4/TrackNetLogDebug.doc

Best Regards,
Aiden

Aiden Cao

TechNet Community Support

_{Tuesday, February 28, 2012 11:20 PM}

another entry that has me confused: is this machine trying to access itself via UNC or something?

02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Entered
02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Returns 0xC000006A

_{Wednesday, March 7, 2012 9:01 PM}

another entry that has me confused: is this machine trying to access itself via UNC or something?

02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Entered
02/28 15:31:49 [LOGON] Domain: SamLogon: Network logon of workstation\Administrator from workstation Returns 0xC000006A

I'm still a little confused about this one: what is happening on this workstation that it's making a network logon from itself, to itself?

_{Monday, May 7, 2012 3:56 PM}

I'm confused by this as well.  I'm trying to track down a chronic lockout problem for a user and I'm seeing the same thing where SamLogon:  Network logon of domain\user from servername Returns 0xc000234.

servername = the server I'm remoted into.  I've tracked the transitive logons back to this server, a domain controller, but now I'm seeing what looks like a loop.  I've looked at taskman to make sure I don't see any processes using his username.

Can anyone from MS shed some light on this?

_{Thursday, May 12, 2016 1:39 PM}

We see this as well but for us its when the users are logging into a citrix session. 

_{Wednesday, April 12, 2017 3:40 PM}

Links are broken

_{Thursday, December 7, 2017 3:21 PM}

This is a sign of virus guys your workstation are attacking each other via logon. You probably have pinkslip or emotet worm or qakbot