Security Logs Flooded

Posted on 2009-02-11
Last Modified: 2013-12-04
The security logs on one of the domain controllers is flooded with object access events. In 1 minute I receive over 20K of events. I've disabled all auditing on both the domain and DC policies and they're still coming in. I'm also getting repeated lockouts on one of the domain admin accounts.
Question by:brent4257
    1 Comment
    LVL 1

    Accepted Solution

    I discovered auditing can also be configured locally even on a domain controller. Once I turned off the domain and domain controller policy the local policy kicked in. It was configured by a previous admin and unknown to anyone. The policy had all auditing turned on thus the huge increase in events. By running gpedit.msc on the DC I was able to disable all the auditing and thus review the security logs. All DCs had to be examined this way to prevent any further incidents. Once this was done we reset the domain and domain controller audit policy back. Additionally we used ADSIedit and discovered on the security of the domain, configuration, and schema partitions that auditing had be set. Logs are now back reporting normally.

    Featured Post

    Highfive + Dolby Voice = No More Audio Complaints!

    Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

    Join & Write a Comment

    This is a guide to the following problem (not exclusive but here) on Windows: Users need our support and we supporters often use global administrative accounts to do this. Using these accounts safely is a real challenge. Any admin who takes se…
    In a recent article here at Experts Exchange (, I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
    Hi everyone! This is Experts Exchange customer support.  This quick video will show you how to change your primary email address.  If you have any questions, then please Write a Comment below!
    This video discusses moving either the default database or any database to a new volume.

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    24 Experts available now in Live!

    Get 1:1 Help Now