LogonType as 3 (network) does not always means network access to shared resource. From Microsoft documentation: "This logon type is intended for high performance servers to authenticate plaintext passwords". After successful logon the current thread (in sapstartsrv.exe process) impersonates that user and can perform actions with security context of that user. Please check status of sapstartsrv process and get pid of that if it is active. Try to call some sapstrartsrv functionality with sapcontrol program and provide results here.
↧