Question

What log with code 1149 in it will show you sourceip/logon user name of a remote connection

Answer 1

To view the source IP and logon username of a remote connection with code 1149, you can check the Security Event Log in the Windows Event Viewer.

Step-by-step explanation:

The log with code 1149 that can show you the source IP and logon username of a remote connection is the **Security Event Log** in the Windows Event Viewer. Here are the steps to view this information:

1. Press the Windows key + R to open the Run dialog box.
2. Type 'eventvwr.msc' in the box and press Enter.
3. In the Event Viewer, expand 'Windows Logs' and select 'Security'.
4. Look for event code 1149, which indicates a remote connection.
5. Click on the event to view the details, including the source IP and logon username.

By following these steps, you can access the Security Event Log and identify the source IP and logon username for a remote connection using code 1149.