I have a SQL server that is a domain member running Windows 2008 R2. It is a cluster node in a failover cluster. The security event log is getting flooded with these:
Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 5/17/2012 8:30:19 AM Event ID: 4793 Task Category: Other Account Management Events Level: Information Keywords: Audit Success User: N/A Computer: SqlServer01.domain.com Description: The Password Policy Checking API was called. Subject: Security ID: DOMAIN\ClusterServiceAccount Account Name: ClusterServiceAccount Account Domain: Domain Logon ID: 0xaaaaa Additional Information: Caller Workstation: SqlServer01 Provided Account Name (unauthenticated): - Status Code: 0x0
When I say "flooded," I mean that about 20 of these events get logged to the security log every second, which means the security log is now largely useless as it fills up with these events in under an hour and there's room for nothing else.
I did find this Technet article about it, which gives me a clue as to how to turn the logging of it off, but instead of simply turning the logging off, I'd really rather know what exactly is causing it, why it's doing it, and how to make it stop calling the password policy checking API.