M
Markko Meriniit
Hello,
although I know what events 538/540 pairs are in security log and the
amount logged is not yet problem because it's not about every computer, but
I'm getting kind of worried, if there going to be more and more computers
like that. Server in question is file/print server, domain member. And we
get literally hundred 538/540 events per second for one computer account.
Events are :
540 Successful Network Logon:
User Name: ARV0216$
Domain: DOMAIN
Logon ID: (0x0,0x12B05AB3)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: %8
538 User Logoff:
User Name: ARV0216$
Domain: DOMAIN
Logon ID: (0x0,0x12B05AB3)
Logon Type: 3
These event pairs occur up to 112(maybe even more, but it was largest number
what I saw) times per second, that is 56 pairs per second.
I did little statistics for three computer accounts:
ARV0161
There was some regularity for this account, always 36 events in time. Mostly
36 per second but sometimes 36 per 2 second. And amount for this 36 event
bursts per minute varied from 1 to 9 per minute.
Events generated for this account for two hour period was about 10 000
---------
ARV0182
I counted max 96 events per second for this account and 3200 events for half
hour period. Didn't see any regularities for this account.
---------
ARV0190
I counted max 112 events per second and max 883 events per minute for this
account and 5100 events for 45 minute hour period. Didn't see any
regularities for this account.
---------------------------------
Is it normal for file/print servers? And why does some computer must do
logon/logoff some 440 times in one minute.. I took a look for local computer
event log and didn't see much activity. Only events that were happened in
same time sometimes were Security 515 events:
A trusted logon process has registered with the Local Security Authority.
This logon process will be trusted to submit logon requests.
Logon Process Name: KSecDD
Any comments or experiences from someone? Thank you.
Markko Meriniit
although I know what events 538/540 pairs are in security log and the
amount logged is not yet problem because it's not about every computer, but
I'm getting kind of worried, if there going to be more and more computers
like that. Server in question is file/print server, domain member. And we
get literally hundred 538/540 events per second for one computer account.
Events are :
540 Successful Network Logon:
User Name: ARV0216$
Domain: DOMAIN
Logon ID: (0x0,0x12B05AB3)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: %8
538 User Logoff:
User Name: ARV0216$
Domain: DOMAIN
Logon ID: (0x0,0x12B05AB3)
Logon Type: 3
These event pairs occur up to 112(maybe even more, but it was largest number
what I saw) times per second, that is 56 pairs per second.
I did little statistics for three computer accounts:
ARV0161
There was some regularity for this account, always 36 events in time. Mostly
36 per second but sometimes 36 per 2 second. And amount for this 36 event
bursts per minute varied from 1 to 9 per minute.
Events generated for this account for two hour period was about 10 000
---------
ARV0182
I counted max 96 events per second for this account and 3200 events for half
hour period. Didn't see any regularities for this account.
---------
ARV0190
I counted max 112 events per second and max 883 events per minute for this
account and 5100 events for 45 minute hour period. Didn't see any
regularities for this account.
---------------------------------
Is it normal for file/print servers? And why does some computer must do
logon/logoff some 440 times in one minute.. I took a look for local computer
event log and didn't see much activity. Only events that were happened in
same time sometimes were Security 515 events:
A trusted logon process has registered with the Local Security Authority.
This logon process will be trusted to submit logon requests.
Logon Process Name: KSecDD
Any comments or experiences from someone? Thank you.
Markko Meriniit