Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)?

This app generates 100K+ of windows logon events in a day. I've seen a lot of instructions to simply disable auditing as a whole but nothing to suppress this one specific type.

share|improve this question
up vote 2 down vote accepted

The newer Windows versions allow for a more granular control of audit events using policies or auditpol.exe but even there you can only select whole "subcategories" and not single event logon types.

If you need a more granular filter, you probably would have to resort to some external logging server solution. You could use the Snare Agent to collect, filter and forward your events to a syslog server like Kiwi syslog.

share|improve this answer
I'm already using the Snare agent in conjunction with a Syslog-NG / Splunk server... I was just hoping not to pollute my original copies as well. Thanks for the answer even if it wasn't what I wanted to hear. – Tim Brigham Jan 5 '12 at 18:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.