up vote 2 down vote favorite
share [g+] share [fb]

I have a win 2K3 domain controller that has sudddenly started logging about 60 events a second. All events are ID 538, 540 and 576

All events pertain to Security Audit of the machine itself logging in successfully. a typical entry is

Event Id 540 Successful Network Logon: User Name: <machinename>$

Any pointers to how I can diagnose this? CPU and memory are normal on the machine.

link|improve this question
This is normal behavior from what I have seen. But 60 of those a second seems like a lot, but you did not tell us how many machines you have on your network. – xeon Apr 16 '10 at 22:57
While there are about 80 machines connect to the DC, all events pertain to the DC machine itself logging on. – user40766 Apr 17 '10 at 15:47
Have you tried rebooting? – user42943 May 12 '10 at 15:39
feedback

1 Answer

up vote 1 down vote

It is more than likely being caused by an audit privilege setting. Check those and you my find your answer.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.