Spurious Logon/Logoff Success Auidt events

Discussion in 'Security Software' started by Patrick, May 3, 2005.

  1. Patrick

    Patrick Guest

    I did an in-situ upgrade of a Win 2K domain controller to Win 2K3. Now I get
    heaps of Success Audit events in the Security log. Ther are all 540, 538,
    576 (logon/logoff) most from the server itself.

    Any ideas why this is happenning?


    Patrick, May 3, 2005
    1. Advertisements

  2. Windows 2003 by default enable a lot of auditing by default unlike Windows
    2000. For a domain controller you may want to disable auting of "logon"
    events but leave auditing of "account logon" events in Domain Controller
    Security Policy. --- Steve
    Steven L Umbach, May 3, 2005
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.