We help IT Professionals succeed at work.

Hoist the colors! We’ve added location flags to usernames sitewide, so it's easier to connect with the global community on EE. View My Profile

x

Security Log Question

stephen1102897
on
742 Views
Last Modified: 2013-12-28
Hello,
      I have a question about some entries in my security log. I am running NT 4.0(SP2) as my server, with Win95 clients, and in the security log I occasionally get these type of entries for different users:
---
Successful Logon:
       User Name:      DP
       Domain:            NTSERVER1
       Logon ID:            (0x0,0x1CC2E74)
       Logon Type:      3
       Logon Process:      KSecDD
       Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
       Workstation Name:      \\PC-DLP
---
Time stamped 07:24:56, then:
---
Successful Logon:
       User Name:      DP
       Domain:            NTSERVER1
       Logon ID:            (0x0,0x1CC2E94)
       Logon Type:      3
       Logon Process:      KSecDD
       Authentication Package:      MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
       Workstation Name:      \\PC-DLP
---
Time stamped 07:25:01, then:
---
User Logoff:
       User Name:      DP
       Domain:            NTSERVER1
       Logon ID:            (0x0,0x1CC2E74)
       Logon Type:      3
---
Time stamped 07:25:01, then:
---
User Logoff:
       User Name:      DP
       Domain:            NTSERVER1
       Logon ID:            (0x0,0x1CC2E94)
       Logon Type:      3
---
 Time stamped 07:25:06.
---

Its not always the same users, and it repeats this cycle for a while before it seems to stay connected. Could someone clue me in on why this is happening? The users do not seem to have any problems on their workstations, but it does tend to fill up the log.

--
Thank You,

Stephen N. Stremmel
Systems Administrator
LCT, Inc.
Houston, Texas
sstremmel@lct.com
Comment
Watch Question

j2

Commented:
Seems to me that some users have auditing enabled, it is the only real reason as to why a succesful logon/logoff would be entered in the log. If you wish to remove these log entries, just disable the auditing.

Author

Commented:
But WHY are the workstations loggin on/off so rapidly when the user is not logging on/off? Thats the real question. Thats what I REALLY want to know. Did you even LOOK at the time stamps in my message???
j2

Commented:
Well, i think one message is when the user logs of the WS, and the other is the WS logging of the domain.

Never ran any auditing on my systems... tho....

Author

Commented:
Look at the timestamps. Why is the PC loggin on and off so rapidly. There are no apparent connection problems from the client side, and the users are not logging on and off, yet the log shows the PC logging on and off quickly. Why is the client PC doing this, OR why is the Security Log showing it if it is NOT happening? It looks as though it IS happening on the server, so what is the deal?
Commented:
This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.