A few weeks ago I implemented a scheduled task that executes every 20 minutes on every workstation and server in the organization. This task runs under the local system account.
Since that date I have had a massive increase in the number of logon events (4624 and 4634) generated by all of my systems. This is a problem for my Splunk licensing.
Other than rewriting the executable this task fires into a full fledged service is there any way to change this behavior? I'd think that an executable run on the local box with local permissions wouldn't require authenticating to the domain controller.