We have a Windows 2003 domain with about 85 XP SP2 workstations. One of the member servers is getting thousands of Security log entries every hour from about 6 user logons. This server is a file server with internal sharepoints, a third-party, SQL Server-based database, and works as the TrendMicro central computer. We are using the default security audit settings. The seurity log is set for 16mb and and presently only holds the last 24-36 hours of activity. We don't want to turn off security logging. How do we track down and turn off this activitiy?
The Event IDS are 538, 576, and 540. We suspect some kind of Kerberos "token leak". Anyone have a clue?