Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a SQL server that is a domain member running Windows 2008 R2. It is a cluster node in a failover cluster. The security event log is getting flooded with these:

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          5/17/2012 8:30:19 AM
Event ID:      4793
Task Category: Other Account Management Events
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      SqlServer01.domain.com
Description:
The Password Policy Checking API was called.

Subject:
    Security ID:        DOMAIN\ClusterServiceAccount
    Account Name:       ClusterServiceAccount
    Account Domain:     Domain
    Logon ID:       0xaaaaa

Additional Information:
    Caller Workstation: SqlServer01
    Provided Account Name (unauthenticated):    -
    Status Code:    0x0

When I say "flooded," I mean that about 20 of these events get logged to the security log every second, which means the security log is now largely useless as it fills up with these events in under an hour and there's room for nothing else.

I did find this Technet article about it, which gives me a clue as to how to turn the logging of it off, but instead of simply turning the logging off, I'd really rather know what exactly is causing it, why it's doing it, and how to make it stop calling the password policy checking API.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Answered my own question. SQL calls that Windows API very rapidly if you have certain service accounts that hit the database very rapidly, and if "Enforce Password Policy" is checked on those accounts. You can either stop the behavior, or you can stop the logging of it via either GPO or local security policy. I chose to stop the behavior by unchecking the "Enforce Password Policy" option on certain key SQL service account logins, and I can confirm that my Windows Security event log is once again under control.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.