token leak?

Posted on 2007-04-09
Medium Priority
Last Modified: 2008-04-19
We have a Windows 2003 domain with about 85 XP SP2 workstations. One of the member servers is getting thousands of Security log entries every hour from about 6 user logons. This server is a file server with internal sharepoints, a third-party, SQL Server-based database, and works as the TrendMicro central computer. We are using the default security audit settings. The seurity log is set for 16mb and and presently only holds the last 24-36 hours of activity. We don't want to turn off security logging. How do we track down and turn off this activitiy?

The Event IDS are 538, 576, and 540.  We suspect some kind of Kerberos "token leak".  Anyone have a clue?
Question by:Barnabus2006
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 2
  • +2
LVL 38

Expert Comment

ID: 18877878
Doesn't SQL Server authenticate (or something like that) every 10 seconds - by default?

I would review the actual 'Audit' settings and decide if some of them can't be eliminated.

You can also increase the size of your Security log beyond 16 MB - but that will just give you lots more room to store (possibly) unneeded events.

LVL 29

Expert Comment

by:Alan Huseyin Kayahan
ID: 18877972
                Hi Barnabus2006
                  Yes this is a Token leak issue. And the reason is TrendMicro. In my opinion, only way is setting auditing policy not to audit these actions.
LVL 32

Expert Comment

ID: 18878493
This could be it (at least for the 576 events)


But this hotfix was supposedly included in SP1 for 2003 - are you at SP1?
Get real performance insights from real users

Key features:
- Total Pages Views and Load times
- Top Pages Viewed and Load Times
- Real Time Site Page Build Performance
- Users’ Browser and Platform Performance
- Geographic User Breakdown
- And more


Author Comment

ID: 18886964
    We are at WS2003 SP1.  Microsoft forums talk about fixing token leaks all the time via hot fixes and especially service packs.  We may see some relief with the recent release of SP2, however, we aren't ready to install that.
    Trend certainly could be the culprit, however, why then would only 6 of the workstations have the issue?
    SQL may be part of the issue, however, these 6 users fill the event log without manually or automatically starting any SQL processes.

Accepted Solution

karensox earned 1000 total points
ID: 18902892
Possible solution, though it seems way off beam...

I had this problem and found that, in part, it was due to the HP Toolbox that was installed on some of the users pc's.   (Which gels with yours only coming from 6 users).

If you want to be able to get a scan from the HP multifunction directly from your desktop then you need to install the full (over)blown HP Toolbox - which includes TomCat (hpbpsttp.exe). Then, every 30 seconds TomCat runs a port resolver (hpbpro.exe) which then can add up to 28 entries in 1 second for each of the users that has the HP Toolbox installed... just brilliant :-\ Apparently the port resolver below version 1.05 is leaky and causes these sort of issues (incl. chewing cpu, memory). The latest is version 2.0.45 but just try getting hold of it... don't even bother with hpbprofix.exe as it still installs a leaky older version of the module.

If your users only want the software installed so they can scan, then remove the TomCat entry from the Run branch of the LM registry. (Obviously you'll need to log out then back in again to stop the app after removing it from registy.) The only thing they won't be able to do is run the HP Toolbox which is a web interface to the printer and fax capabilities.

• HP Toolbox app (hpbpsttp.exe) may not appear in your Task Manager - it didn't on any of my client boxes.
• hpbpro.exe only appears for a split second every 30 seconds in Task Manager - screen shot when you see the flicker to confirm (on client box).

So now I have stopped all the extra authentications from domain users, but am still left with the problem that the SYSTEM user is logging multiple 538/540/576 entries. Aaarrgghh!


Author Comment

ID: 18908496
We'll take a look at that. If not HP is may be a similar third-party issue.
LVL 38

Expert Comment

ID: 18909366
karensox - interesting idea.
I got so fed up with all the HP "Full Function/Feature" baloney that I finally downloaded just the "Basic Print and Scan Drivers" and just loaded that.
It got rid of all the misc junk and now runs fine.

LVL 32

Expert Comment

ID: 18910385
My personal bugbear is not HP software on 2003 - but Brother software...

(but that is another story!)
LVL 38

Expert Comment

ID: 18911263
... Oh, brother!

Author Comment

ID: 19015517
THANKS!!!  You weren't way off beam (gymnast are you?).
We removed and reloaded the HP 1010 software.  A custom reload allowed us to skip installing anything but driver-related functionality.  We tried removing the Tomcast web service fromt the registry RUN key.  It worked but we chose the more "elegant" solution of a clean reinstall.
LVL 38

Expert Comment

ID: 19016307
Karensox - way to go!

Welcome to E-E and hurry up and get your 10,000 points.
It is even more fun when you can ask all the questions you want for free.


Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Setting up a Microsoft WSUS update system is free relatively speaking if you have hard disk space and processor capacity.   However, WSUS can be a blessing and a curse. For example, there is nothing worse than approving updates and they just have…
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question