Recently a user asked me if I would look into the VPN connection because they were being booted off constantly. I went to Event Viewer to see the logon/logoff events from last night.
Out of the 47k security events from the last few days, I had 44k of them. They are almost all Event #540 "Successful Network Logon" and #576 "Special privileges assigned to new logon."
Similar to this question, but it wasn't really answered: A lot of logon/logoffs events in Windows event log
Why is this happening? Is it an issue? If so what are steps to fix it?
Special privileges assigned to new logon: User Name: gtaylor Domain: Domain Logon ID: (0x0,0x30D14A8) Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Successful Network Logon: User Name: gtaylor Domain: Domain Logon ID: (0x0,0x3282453) Logon Type: 3 Logon Process: NtLmSsp Authentication Package: NTLM Workstation Name: D-7P9LDP1 Logon GUID: - Caller User Name: - Caller Domain: - Caller Logon ID: - Caller Process ID: - Transited Services: - Source Network Address: 192.168.1.175 Source Port: 54450 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Pic of Event Viewer: http://i.stack.imgur.com/Cyu0v.jpg