0

I have a SBS 08 with 50 users on my domain. In Event Viewer : Windows Logs > Security, I've got nearly 300,000 events about EventID 4624 Logon, 4634 Logoff, 4776 Credential Validation, 4769 Kerberos Service Ticket Operations in only... 2 days !!!

I want to simply disable it. I tried disabling the audit in the Local Policy or Group Policy but everything is greyed: Security Settings > Local Policies > Audit Policy > Audit logon events : No Auditing

Improve this question
3
  • 2
    I know this isn't what you asked for but you really need to find out what is causing this, as it is not normal behaviour, and fix it. What you're asking for is akin to just wrapping more bandages around a wound without stopping to ask "Hold on a moment, why am I actually bleeding like this anyway".
    – Rob Moir
    Nov 3, 2010 at 19:24
  • Robert is right. You're looking at hiding the problem instead of making it go away.
    – John Gardeniers
    Nov 3, 2010 at 21:15
  • I found that most of these events, have : Logon Type : 3 which mean that it's a network access like Shared folder. I have lots of them, and every users have automatic mounted shared folders. This may be an explanation why there's so much event.
    – Bastien974
    Nov 5, 2010 at 13:13

4 Answers 4

Reset to default
1

Look for an HP printer that loads up an apache web service.

I had 50,000 Kerb errors on my DC with that funky printer client on one of my workstations.

Like others have said, find the underlying cause, don't mask what's going on.

Improve this answer
2
  • I have a network HP printer with apache, but nothing in my Audit about it.
    – Bastien974
    Nov 5, 2010 at 13:09
  • I don't want to disable all only certain ones that match certain parameters.
    – ggb667
    Apr 28, 2021 at 19:55
1

If everything is greyed out here: start > run > gpedit.msc Local Computer Policy

Windows Settings

Security Settings

Local Policies

Audit Policy

Properties of Audit Logon Events

Then you dont have permission to update group policy on the domain / server. Once you have secured the ability to edit gpol, then you will be able to disable successful audits. Once you have disabled them, run 'gpupdate /force' to force an update of gpol on the server.

Improve this answer
1

I believe I stopped logging logon/logoff events by: Opening local security policy Security Settings->Advanced Audit Policy Configuration-> System Audit Policies->Logon/Logoff:

By default both Audit Logoff and Audit Logon are not configured. Right click each-Properties. Check Configure the following audit events. Do not check Success or Failure.

After I applied this these events stopped getting logged.

Improve this answer
1
0

I believe the SBS is also most likely your DC, some of these events would typically be spread out over multiple servers. I would venture a guess that it's audit policies are being defined by the Default Domain Controllers GPO or some other GPO that is overriding your settings here. Policies resolve (or used to) local, site, domain, OU. Most likely the default domain controller policy doing this.

I really don't think thats a lot of events. I would run GPresult.msc to see where that setting is coming from, and then go make the adjustment.

Tom

Improve this answer
6
  • Also, lookup the difference between logon events and account logon events!
    – SpacemanSpiff
    Nov 3, 2010 at 19:06
  • I looked for a Policy where the Audit was configured, but nothing except mine : Audit account logon events -> No auditing / Audit logon events -> No auditing I try to configure a simple audit for Successful deletion of file, nothing show up in the EventViewer, something is overriding the config.
    – Bastien974
    Nov 3, 2010 at 20:47
  • Use the resultant set of policy MMC snap-in (gpresult.msc) to determine where the setting is coming from.
    – SpacemanSpiff
    Nov 3, 2010 at 21:16
  • I runned a gpresult /R and checked every Applied group policy Objects. I didn't find anything asking to audit logon/logoff.
    – Bastien974
    Nov 4, 2010 at 12:30
  • The MMC snap-in should let you go down the policy from the GUI and navigate to the set attribute and it will tell you what policy is governing in, be it local, GPO, etc., EDIT: sorry, its rsop.msc
    – SpacemanSpiff
    Nov 4, 2010 at 15:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .