Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a SBS 08 with 50 users on my domain. In Event Viewer : Windows Logs > Security, I've got nearly 300,000 events about EventID 4624 Logon, 4634 Logoff, 4776 Credential Validation, 4769 Kerberos Service Ticket Operations in only... 2 days !!!

I want to simply disable it. I tried disabling the audit in the Local Policy or Group Policy but everything is greyed: Security Settings > Local Policies > Audit Policy > Audit logon events : No Auditing

share|improve this question
2  
I know this isn't what you asked for but you really need to find out what is causing this, as it is not normal behaviour, and fix it. What you're asking for is akin to just wrapping more bandages around a wound without stopping to ask "Hold on a moment, why am I actually bleeding like this anyway". –  RobM Nov 3 '10 at 19:24
    
Robert is right. You're looking at hiding the problem instead of making it go away. –  John Gardeniers Nov 3 '10 at 21:15
    
I found that most of these events, have : Logon Type : 3 which mean that it's a network access like Shared folder. I have lots of them, and every users have automatic mounted shared folders. This may be an explanation why there's so much event. –  Bastien974 Nov 5 '10 at 13:13

3 Answers 3

Look for an HP printer that loads up an apache web service.

I had 50,000 Kerb errors on my DC with that funky printer client on one of my workstations.

Like others have said, find the underlying cause, don't mask what's going on.

share|improve this answer
    
I have a network HP printer with apache, but nothing in my Audit about it. –  Bastien974 Nov 5 '10 at 13:09

If everything is greyed out here: start > run > gpedit.msc Local Computer Policy

Windows Settings

Security Settings

Local Policies

Audit Policy

Properties of Audit Logon Events

Then you dont have permission to update group policy on the domain / server. Once you have secured the ability to edit gpol, then you will be able to disable successful audits. Once you have disabled them, run 'gpupdate /force' to force an update of gpol on the server.

share|improve this answer

I believe the SBS is also most likely your DC, some of these events would typically be spread out over multiple servers. I would venture a guess that it's audit policies are being defined by the Default Domain Controllers GPO or some other GPO that is overriding your settings here. Policies resolve (or used to) local, site, domain, OU. Most likely the default domain controller policy doing this.

I really don't think thats a lot of events. I would run GPresult.msc to see where that setting is coming from, and then go make the adjustment.

Tom

share|improve this answer
    
Also, lookup the difference between logon events and account logon events! –  SpacemanSpiff Nov 3 '10 at 19:06
    
I looked for a Policy where the Audit was configured, but nothing except mine : Audit account logon events -> No auditing / Audit logon events -> No auditing I try to configure a simple audit for Successful deletion of file, nothing show up in the EventViewer, something is overriding the config. –  Bastien974 Nov 3 '10 at 20:47
    
Use the resultant set of policy MMC snap-in (gpresult.msc) to determine where the setting is coming from. –  SpacemanSpiff Nov 3 '10 at 21:16
    
I runned a gpresult /R and checked every Applied group policy Objects. I didn't find anything asking to audit logon/logoff. –  Bastien974 Nov 4 '10 at 12:30
    
The MMC snap-in should let you go down the policy from the GUI and navigate to the set attribute and it will tell you what policy is governing in, be it local, GPO, etc., EDIT: sorry, its rsop.msc –  SpacemanSpiff Nov 4 '10 at 15:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.