Solved

Thousand of occurrence in the security log

Posted on 2008-10-31
2
373 Views
Last Modified: 2010-03-05
My security log at my SBS2003 server fills up with thousand of occurrence every hour even thou if i turned off the logon/logoff. Ayone who can help me? I've had this problem for a while noe and my server go down because it genrated so many occurrence in the security log. I've tried to use Domain Security Controller to turn off the monotoring but my Security log still fills up.
Anyone can help?
0
Comment
Question by:scancom
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 59

Accepted Solution

by:
Darius Ghassem earned 500 total points
ID: 22852496
0
 
LVL 18

Expert Comment

by:sk_raja_raja
ID: 22853418
1.Large ammount of 538 and 540 events in your case indicates that users connect (or disconnect from) to your server's shares - nothing else. This event are rom Logon/Logoff audit policy which can be disabled. If I understand you correctly you should have Object access audit policy enabled. If your Security log is filling up with events to quickly, increase the log size or disable some of the auditing policies.

2.It may be that the machine has been elected as the master browser for that subnet.  Everytime someone makes a request for the browser list it would log an anonymous logon/logoff in the security log and browstat status will tell you who the master browser is
0

Featured Post

Backup Solution for AWS

Read about how CloudBerry Backup fully integrates your backups with Amazon S3 and Amazon Glacier to provide military-grade encryption and dramatically cut storage costs on any platform.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting an…
Remote Apps is a feature in server 2008 which allows users to run applications off Remote Desktop Servers without having to log into them to run the applications.  The user can either have a desktop shortcut installed or go through the web portal to…
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

730 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question