Disable auditing of logon type 3 events

Question

I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)?

This app generates 100K+ of windows logon events in a day. I've seen a lot of instructions to simply disable auditing as a whole but nothing to suppress this one specific type.

Answer 1

The newer Windows versions allow for a more granular control of audit events using policies or auditpol.exe but even there you can only select whole "subcategories" and not single event logon types.

If you need a more granular filter, you probably would have to resort to some external logging server solution. You could use the Snare Agent to collect, filter and forward your events to a syslog server like Kiwi syslog.