up vote 1 down vote favorite
share [g+] share [fb]

One of my domain controllers is an abnormally large number of windows auditing events. The common thread I have been able to identify is that 90% of these logs share a common SID. Several thousand may be generated in a given set.

The user SID referenced is SYSTEM. When this occurs on DC1 DC2 is referenced as event user and visa-versa. These sets are occurring at exactly 5 minute increments. I have already checked the windows event logs scheduled tasks, even the checks I have running from Nagios. Nothing has pointed to a source for this behavior.

I did manage to move this behavior from one DC to the next by rebooting.

How can I track down exactly what is running with this SID to determine the cause of this behavior?

EDIT:

I have tried running dcdiag and repadmin to see if this is directly related to the DC roles on these boxes. No errors are reported. Searching for the GUID and invocation ID in the windows event log doesn't help.

link|improve this question
93% accept rate
Can you specify more details on the event id, and any event details you can share? – Lucky Luke Feb 16 at 18:10
That is what makes this so odd. The events in question are the standard logon / logoff events, 4634 and 4624 primarily. – Tim Brigham Feb 16 at 19:19
Is there a pattern as to the time of day they occur? E.g., during work hours (assuming 9-5 days), or just throughout the entire day? Also, what is the logon type of the 4624/4634 events? 3? – Lucky Luke Feb 16 at 20:56
Throughout the entire day. Logon type 3. – Tim Brigham Feb 16 at 21:18
Thanks. What is the source IP address / computer in the event? Is is the IP of the DC? How many events are generated, you mentioned an abnormally large amount, but that's subjective. – Lucky Luke Feb 16 at 22:36
show 2 more comments
feedback

1 Answer

up vote 0 down vote

The GUID would resolve to the same, i.e. SYSTEM. See this article.

The eventlog entry should contain the ProcessName and ProcessId which will tell you where the logs are coming from.

link|improve this answer
There were several sessions for the SYSTEM account that existed, each with a unique SID. I don't see a way to determine which session a given executable is running under. Considering the number of applications that run under the SYSTEM account on a DC I was wanting to narrow the scope down a bit. – Tim Brigham Feb 9 at 21:01
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.