Success Logins



I am working with a SBS 2003 that is not used very much. I am getting a
lot of successful logins and logouts from what looks to be a machine ID.

The user id has the user name with a $ at the end of it. These logins and
logouts happen within minutes and are constant? Is this something exchange
can be initiating, or something else, I should be concerned about?

Event 540s and 538s.




Steven L Umbach

The $ in front of the name would indicate a machine account. This is usually
normal as there is a lot of activity between domain computers and domain
controllers or servers. I would not be too concerned except for failed
logons and if strange computer names start appearing. If you are curious you
could use netmon on the server to see more about this activity such as
source and destination ports. For domain controllers you may want to enable
auditing of account logons for successful and failure and logon events for
failure only to reduce the events recorded.. --- Steve

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question