Looking at the event log - loads of log ons / log offs? Does that make sense?
Posted on 2008-06-22
on an SBS 2003 R2 box, the boss wanted me to monitor a folder to see if a specific employee was accessing the files overnight. I enabled auditing any actions for that folder. looking in the event log, I could see loads of opject access entries for those files during work hours.
But I happened to notice on a day with no access to those files (not sure if he was out with the PC turned on or just didn't use those files), there's loads of logon / logoff envent 540 & 538s within seconds, starting at 4:52 and then ending at 4:55PM. any thoughts on why there were so many in that short span?