Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A few weeks ago I implemented a scheduled task that executes every 20 minutes on every workstation and server in the organization. This task runs under the local system account.

Since that date I have had a massive increase in the number of logon events (4624 and 4634) generated by all of my systems. This is a problem for my Splunk licensing.

Other than rewriting the executable this task fires into a full fledged service is there any way to change this behavior? I'd think that an executable run on the local box with local permissions wouldn't require authenticating to the domain controller.

share|improve this question
up vote 0 down vote accepted

It does not appear that there is a ready way to eliminate this logging so I created a small service around the code for the original executable.

share|improve this answer
Just out of morbid curiosity, what did you have running every 20 minutes on every machine? – mfinni Jan 27 '12 at 22:23
I needed a better way to address client side targeting. I have previous questions about it, including – Tim Brigham Jan 28 '12 at 0:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.