Other users in security log event viewer

[gmc8757]

I have a few different users show up in my security log of my event viewer. I know if someone tries to c$ it will show a logon/logoff entry for that user. No one should be doing that though, and the users who show up in the viewer, I doubt would even know how to do that. Why else would other users show up in my security log?

I know i can lock it down with group policy, but I'd like to know why they show up there. Any clues?

Thanks.

 

[Rilex]

Provide the entire entry.

 

[gmc8757]

Sorry it took a lil while for me to get back to you, been out of the office. Anyway, here is an example below. This userA doesn't even know how to do c$ or any other way of loggin into my pc. So do you think they are infected, or I'm infected? I can show you more, like computername$ logon/logoff entries as well as users.


Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 12/22/2006
Time: 4:19:51 PM
User: thedomain\userA
Computer: computerA
Description:
User Logoff:
User Name: userA
Domain: thedomain
Logon ID: (0x0,0x9979C0B)
Logon Type: 3

 

[RebateMonger]

Logon Type: 3 is a network logon.

Are you sharing any folders or printers?

 

[gmc8757]

Only the administrative shares. No open shares where these users could log into. That's what raised the concern because there is no use for the user perform a network logon to this computer.