I have a win 2K3 domain controller that has sudddenly started logging about 60 events a second. All events are ID 538, 540 and 576

All events pertain to Security Audit of the machine itself logging in successfully. a typical entry is

Event Id 540 Successful Network Logon: User Name: <machinename>$

Any pointers to how I can diagnose this? CPU and memory are normal on the machine.

  • This is normal behavior from what I have seen. But 60 of those a second seems like a lot, but you did not tell us how many machines you have on your network.
    – xeon
    Apr 16, 2010 at 22:57
  • While there are about 80 machines connect to the DC, all events pertain to the DC machine itself logging on.
    – user40766
    Apr 17, 2010 at 15:47
  • Have you tried rebooting?
    – user42943
    May 12, 2010 at 15:39

1 Answer 1


It is more than likely being caused by an audit privilege setting. Check those and you my find your answer.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.