I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)?
This app generates 100K+ of windows logon events in a day. I've seen a lot of instructions to simply disable auditing as a whole but nothing to suppress this one specific type.
The newer Windows versions allow for a more granular control of audit events using policies or auditpol.exe but even there you can only select whole "subcategories" and not single event logon types.
If you need a more granular filter, you probably would have to resort to some external logging server solution. You could use the Snare Agent to collect, filter and forward your events to a syslog server like Kiwi syslog.
We had the same exact problem, but instead of IIS we had a rogue application generating thousands of type 3's per day on all of our client machines. We were able to solve this using Cymbal SIEM and working with them to discard undesired events. Unfortunately Microsoft does not give us granular control beyond 'Audit Success / Audit Failure' on the local endpoint, so you won't be able to control it at that layer.
In an enterprise setting though, you should be parsing events through your SIEM tool instead of on the local endpoint. Your SIEM tool will likely receive its event data from a centralized collection server sitting inside your network. Our SIEM provider was able to provide us with the right filters using custom XML queries to prevent any undesired events from getting sent to our collection server. They said that with a centralized architecture it doesn't matter which events types the local end-point captures and that we could actually lower the security log size down to single digits MB's if we wanted. With this type of setup, the local security log just becomes a temporary caching place for events to sit until they are picked up by the collection server (which is usually instantaneously).
As long as you get a proper SIEM tool, you will be able to have dashboard and filter to see which ones you want.
They said that with a centralized architecture it doesn't matter which events types the local end-point captures and that we could actually lower the security log size down to single digits MB's if we wanted. In almost every organization, the events captured are determined by policy, not by technology or a SIEM provider. Also lowering the event log to that size is not a good idea if the logging destination were momentarily unavailable. That would result in lost events on high volume systems.
Feb 15, 2023 at 9:56