token leak?

We have a Windows 2003 domain with about 85 XP SP2 workstations. One of the member servers is getting thousands of Security log entries every hour from about 6 user logons. This server is a file server with internal sharepoints, a third-party, SQL Server-based database, and works as the TrendMicro central computer. We are using the default security audit settings. The seurity log is set for 16mb and and presently only holds the last 24-36 hours of activity. We don't want to turn off security logging. How do we track down and turn off this activitiy?

The Event IDS are 538, 576, and 540.  We suspect some kind of Kerberos "token leak".  Anyone have a clue?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Doesn't SQL Server authenticate (or something like that) every 10 seconds - by default?

I would review the actual 'Audit' settings and decide if some of them can't be eliminated.

You can also increase the size of your Security log beyond 16 MB - but that will just give you lots more room to store (possibly) unneeded events.

Alan Huseyin KayahanCommented:
                Hi Barnabus2006
                  Yes this is a Token leak issue. And the reason is TrendMicro. In my opinion, only way is setting auditing policy not to audit these actions.
This could be it (at least for the 576 events)

But this hotfix was supposedly included in SP1 for 2003 - are you at SP1?
Cloud Class® Course: Microsoft Windows 7 Basic

This introductory course to Windows 7 environment will teach you about working with the Windows operating system. You will learn about basic functions including start menu; the desktop; managing files, folders, and libraries.

Barnabus2006Author Commented:
    We are at WS2003 SP1.  Microsoft forums talk about fixing token leaks all the time via hot fixes and especially service packs.  We may see some relief with the recent release of SP2, however, we aren't ready to install that.
    Trend certainly could be the culprit, however, why then would only 6 of the workstations have the issue?
    SQL may be part of the issue, however, these 6 users fill the event log without manually or automatically starting any SQL processes.
Possible solution, though it seems way off beam...

I had this problem and found that, in part, it was due to the HP Toolbox that was installed on some of the users pc's.   (Which gels with yours only coming from 6 users).

If you want to be able to get a scan from the HP multifunction directly from your desktop then you need to install the full (over)blown HP Toolbox - which includes TomCat (hpbpsttp.exe). Then, every 30 seconds TomCat runs a port resolver (hpbpro.exe) which then can add up to 28 entries in 1 second for each of the users that has the HP Toolbox installed... just brilliant :-\ Apparently the port resolver below version 1.05 is leaky and causes these sort of issues (incl. chewing cpu, memory). The latest is version 2.0.45 but just try getting hold of it... don't even bother with hpbprofix.exe as it still installs a leaky older version of the module.

If your users only want the software installed so they can scan, then remove the TomCat entry from the Run branch of the LM registry. (Obviously you'll need to log out then back in again to stop the app after removing it from registy.) The only thing they won't be able to do is run the HP Toolbox which is a web interface to the printer and fax capabilities.

• HP Toolbox app (hpbpsttp.exe) may not appear in your Task Manager - it didn't on any of my client boxes.
• hpbpro.exe only appears for a split second every 30 seconds in Task Manager - screen shot when you see the flicker to confirm (on client box).

So now I have stopped all the extra authentications from domain users, but am still left with the problem that the SYSTEM user is logging multiple 538/540/576 entries. Aaarrgghh!


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Barnabus2006Author Commented:
We'll take a look at that. If not HP is may be a similar third-party issue.
karensox - interesting idea.
I got so fed up with all the HP "Full Function/Feature" baloney that I finally downloaded just the "Basic Print and Scan Drivers" and just loaded that.
It got rid of all the misc junk and now runs fine.

My personal bugbear is not HP software on 2003 - but Brother software...

(but that is another story!)
... Oh, brother!
Barnabus2006Author Commented:
THANKS!!!  You weren't way off beam (gymnast are you?).
We removed and reloaded the HP 1010 software.  A custom reload allowed us to skip installing anything but driver-related functionality.  We tried removing the Tomcast web service fromt the registry RUN key.  It worked but we chose the more "elegant" solution of a clean reinstall.
Karensox - way to go!

Welcome to E-E and hurry up and get your 10,000 points.
It is even more fun when you can ask all the questions you want for free.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.