RE: Overload: 562/565 Security Events (Success Audit)

That should be '3000 per minute'. Per second varies with a peak of around 270.
--
swtmike


"swtmike" wrote:

Hello,

we are seeing multipe 562/565 events, mostly as pairs, for a couple of
machines on our Windows 2003 domain at a rate of around 3000 per second.

Part of 562;
Handle Closed:
Object Server: Security Account Manager
Handle ID: 113019808
Process ID: 512
Image File Name: C:\WINDOWS\system32\lsass.exe

Process 512 does not show up in the list of processes viewed via Task
Manager on the workstation.

User: in both events is domain\machinename$.

How would I go about finding which Directory Service Access (565) or Object
Access (562) these refer to or troubleshooting please as this is not typical
behaviour on our network?

Regards,
--
swtmike
.

Quantcast