Exchange 2000 Cluster generates events 578
From: Julio E. Danoviz (jedanoviz_at_hotmail.com)
Date: 07/26/04
- Next message: Kenny Wood: "RE: Problems enabling smart card login on windows 2000"
- Previous message: Julio E. Danoviz: "Exchange 2000 Cluster generates events 578"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 25 Jul 2004 18:42:25 -0700
Hello, after installing an Exchange 2000 Cluster in an
existing email organization we've detected a lot of
security events id 578 on the DCs (more than six per
second).
The company is logging Success Audit for Priviledge Use
based on business reasons... They "need" to maintain this
policy (if possible...).
Before installing the cluster the company's security logs
reached 100 Mb per week, now it's reaching this limit in
hours.
1300 mailboxes and public folders were moved from a member
server to the cluster.
Is this behaviour normal on an Exchange 2000 cluster ???
Here's a snapshot of an event:
Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 578
Date: 7/23/2004
Time: 1:50:07 PM
User: DOMAIN\NODE02$ - (Active Exchange Node)
Computer: DC03 - (Domain Controller)
Description:
Privileged object operation:
Object Server: DS
Object Handle: 3200072916
Process ID: 308 - (This process is DC's LSASS.exe)
Primary User Name: DC03$
Primary Domain: DOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: NODE02$
Client Domain: DOMAIN
Client Logon ID: (0x0,0x51F52C1)
Privileges: SeSecurityPrivilege
Thanks,
Julio E. Danoviz, MCSA+Messaging MCSE MCT
- Next message: Kenny Wood: "RE: Problems enabling smart card login on windows 2000"
- Previous message: Julio E. Danoviz: "Exchange 2000 Cluster generates events 578"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
