Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a win 2K3 domain controller that has sudddenly started logging about 60 events a second. All events are ID 538, 540 and 576

All events pertain to Security Audit of the machine itself logging in successfully. a typical entry is

Event Id 540 Successful Network Logon: User Name: <machinename>$

Any pointers to how I can diagnose this? CPU and memory are normal on the machine.

share|improve this question
This is normal behavior from what I have seen. But 60 of those a second seems like a lot, but you did not tell us how many machines you have on your network. – xeon Apr 16 '10 at 22:57
While there are about 80 machines connect to the DC, all events pertain to the DC machine itself logging on. – user40766 Apr 17 '10 at 15:47
Have you tried rebooting? – user42943 May 12 '10 at 15:39

It is more than likely being caused by an audit privilege setting. Check those and you my find your answer.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.