Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A few weeks ago I implemented a scheduled task that executes every 20 minutes on every workstation and server in the organization. This task runs under the local system account.

Since that date I have had a massive increase in the number of logon events (4624 and 4634) generated by all of my systems. This is a problem for my Splunk licensing.

Other than rewriting the executable this task fires into a full fledged service is there any way to change this behavior? I'd think that an executable run on the local box with local permissions wouldn't require authenticating to the domain controller.

share|improve this question
add comment

1 Answer 1

up vote 0 down vote accepted

It does not appear that there is a ready way to eliminate this logging so I created a small service around the code for the original executable.

share|improve this answer
    
Just out of morbid curiosity, what did you have running every 20 minutes on every machine? –  mfinni Jan 27 '12 at 22:23
    
I needed a better way to address client side targeting. I have previous questions about it, including serverfault.com/q/347129/90351 –  Tim Brigham Jan 28 '12 at 0:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.