Success Audits in event log for username: servername$ is this correct?
I was checking the event logs on the server and I noticed successful security audits for the username: servername$. Hundreds seem to occur everyday and I do not think this is right. the full details are below.....
Successful Network Logon:
User Name: GLAZERITE01$
Domain: GLAZERITE-DOM
Logon ID: (0x0,0x111A2513)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {64d9da07-9e8e-7914-e771-92e9abeecc0d}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: -
Source Port: -
Could someone tell me whether this is correct as I have only ever seen audits for actual usernames in their before i.e administrator or gregd. If this is not correct could someone please tell me how to increase the security?
Thanks in advance
Greg
SBSActive DirectoryWindows Server 2003
Last Comment
snusgubben
8/22/2022 - Mon
snusgubben
That's correct. It's the computer accounts that authenticate to the logon server. It will log alot of events so you can turn successfull logging off if you don't need them by group policy.
Is it normal to have so many a day? also just to confirm GLAZERITE01 is the name of the domain controller so should it be logging events authenticating itself?
Thanks
snusgubben
How often does it occure in the eventlog? What is the Event number?
It's probably just the discrete communication channel between the computer and the domain that are set, or if the computer need access to recources in the domain (i.e. group policy).
Computer Configuration - Windows settings - Local Policues - Audit Policy:
Audit account logon events - Failure
Audit account management - Success
Audit logon events - Failure