At the moment, on a Windows 2000 with SP4 server that is a Domain
Controller, if I have the following policies set with the DC Security
Policy:
Audit Account Logon Events: None
Audit Logon Events: Success+Failures

then I get mulitple events logged for each instance of log-on and log-off

To be precise, for logons, I get Event IDs:
528 Successful Logon
515 A trusted logon process has registered with the Local Security
Authority. This logon process will be trusted to submit logon requests.
540 Successful Network Logon: TWICE

For Logoffs
538 Successful Logoffs: multiple entries

Also very strangely, after LogOffs are logged, I also have logon logged in
the eventviewers:
in fact it's more like
Log off
Log on
Log Off
Log on


when in fact the user has simply issued a log off!

"help" <(E-Mail Removed)> wrote in message
news:c2shp4$34h$(E-Mail Removed)...
> At the moment, on a Windows 2000 with SP4 server that is a Domain
> Controller, if I have the following policies set with the DC Security
> Policy:
> Audit Account Logon Events: None
> Audit Logon Events: Success+Failures
>
> then I get mulitple events logged for each instance of log-on and log-off
>
> To be precise, for logons, I get Event IDs:
> 528 Successful Logon
> 515 A trusted logon process has registered with the Local Security
> Authority. This logon process will be trusted to submit logon requests.
> 540 Successful Network Logon: TWICE
>
> For Logoffs
> 538 Successful Logoffs: multiple entries
>
>

That is normal to see. I believe a lot of those events are computer account
related. For a domain controller you may want to audit account logon events
instead and maybe just failures for logon events. --- Steve

"help" <(E-Mail Removed)> wrote in message
news:c2shp4$34h$(E-Mail Removed)...
> At the moment, on a Windows 2000 with SP4 server that is a Domain
> Controller, if I have the following policies set with the DC Security
> Policy:
> Audit Account Logon Events: None
> Audit Logon Events: Success+Failures
>
> then I get mulitple events logged for each instance of log-on and log-off
>
> To be precise, for logons, I get Event IDs:
> 528 Successful Logon
> 515 A trusted logon process has registered with the Local Security
> Authority. This logon process will be trusted to submit logon requests.
> 540 Successful Network Logon: TWICE
>
> For Logoffs
> 538 Successful Logoffs: multiple entries
>
>