Excessive logon/logoff messages in event log

K

Kevin Porter

I have SBS 2003 Premium. It's a new installation with only one machine
connected to it. I do have Veritas backup software loaded and ISA running.
SQL Server is installed but disabled. Exchange is installed and running.

In the event log, several times a minute, there are logon and logoff events
for the server name, server2$ (server name plus '$'), and the administrator
account, which I haven't renamed yet. The event IDs are 538, 576, and 540.

I realize that I can disable the logging of these events, but I would like
to log legitimate logons and logoffs of users. Is there something wrong in
the system that is causing this activity or is it considered "normal"?

I have looked around and did see another thread about this from September
but didn't see any solution posted other than just disabling the logging of
all of these events.

Thanks - Kevin
 
K

Kevin Porter

The 576 description did point me to this knowledge base article:

http://support.microsoft.com/?kbid=822774

It isn't clear whether this is my problem, but it does discuss a bug where
excessive audit events occur. Unfortunately it a hotfix that I would have
to pay for, even though I already just paid thousands of dollars for the
OS. I guess I should just live without the auditing.

Thanks for the response, Cary. The article was last updated yesterday
(12/4) so I'll keep an eye on it and see if any more information comes to
light.
 
C

Cary Shultz [A.D. MVP]

Kevin,

Glad to be of assistance.

Cary

Kevin Porter said:
The 576 description did point me to this knowledge base article:

http://support.microsoft.com/?kbid=822774

It isn't clear whether this is my problem, but it does discuss a bug where
excessive audit events occur. Unfortunately it a hotfix that I would have
to pay for, even though I already just paid thousands of dollars for the
OS. I guess I should just live without the auditing.

Thanks for the response, Cary. The article was last updated yesterday
(12/4) so I'll keep an eye on it and see if any more information comes to
light.
Click to expand...
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Auditing User logon and logoff, from the event logs on the domain controllers 2
Security event log filling.. 4
Excessive computer account logon/logoff loggining on security log 5
logon log off events 1
Unexplained 540 Events in Security log on W2K workstation in a dom 0
Excessive 538 messages in Security log 1
Logon/lofoff,Lockout entries not in Event log 2
Notification of Logon and Logoff 1

Top