Excessive Logon\Logoff Audits

From: Chris Wilkins (cwilkins_at_gfkcustomresearch.com)
Date: 05/24/04

  • Next message: someoneelse: "Re: 2003 Server / Application Pools - Process Isolation / FrontPage Extensions" 
    Date: Mon, 24 May 2004 11:06:01 -0700

    I have "Audit Logon Events" set to Success, Failure on a Windows 2000 Server. When users access a network resource an Event ID 540 successful logon will be recorded. 10 seconds later (roughly) an Event ID 538 successsul logoff will be recorded followed 1 second later with another EventID 540 successful logon. I double checked the autodisconnect lanmanger registry entry and it's set to 15 minutes. Needless to say my security log is very full. The clients are Windows XP. Here's the strange thing. It doesn't happen with my account. I'm using windows 2k and have admin access to the server.

  • Next message: someoneelse: "Re: 2003 Server / Application Pools - Process Isolation / FrontPage Extensions"