Advertisement

10.02.2007 at 07:36PM PDT, ID: 22868248
[x]
Attachment Details

Windows 2003 domain controller security event log filling with 538 576 and 540 events.

Asked by reesejl in Microsoft Operating Systems, Windows 2003 Server, Active Directory

Tags: event, 538, 540, 576, security

I know that this question has been asked here before, but here goes.
I am working on a Windows 2003 domain where we have a domain controller that has thousands of event IDs 538, 576, and 540 filling up the security log.  The username is always the servername followed by a $

The events stream into the log at a rate of about 30-40 a second.

We are required to audit successful logon and logoffs. We cannot turn off auditing to solve this problem.

What causes all of these events and what can I do to stop them at the source?Start Free Trial
[+][-]10.02.2007 at 07:52PM PDT, ID: 20003730

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10.02.2007 at 08:19PM PDT, ID: 20003806

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10.03.2007 at 07:05AM PDT, ID: 20006619

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]10.03.2007 at 01:01PM PDT, ID: 20009582

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10.03.2007 at 01:35PM PDT, ID: 20009846

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]10.05.2007 at 02:11AM PDT, ID: 20020414

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10.24.2007 at 01:38PM PDT, ID: 20142717

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 7-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]10.24.2007 at 02:15PM PDT, ID: 20142974

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10.26.2007 at 11:34AM PDT, ID: 20157978

View this solution now by starting your 7-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

 

About this solution

Zones: Microsoft Operating Systems, Windows 2003 Server, Active Directory
Tags: event, 538, 540, 576, security
Sign Up Now!
Solution Provided By: reesejl
Participating Experts: 4
Solution Grade: B
 
 
[+][-]10.26.2007 at 01:48PM PDT, ID: 20158913

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 7-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]10.26.2007 at 05:10PM PDT, ID: 20159879

Experts Exchange has a courteous staff of administrators who help members get the most out of the website by means of administrative comments like this one.

Start your 7-day free trial to view this Administrative Comment or ask the Experts your question.

 
 
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_1_20070628