Security Logs Flooded

Posted on 2009-02-11
Medium Priority
Last Modified: 2013-12-04
The security logs on one of the domain controllers is flooded with object access events. In 1 minute I receive over 20K of events. I've disabled all auditing on both the domain and DC policies and they're still coming in. I'm also getting repeated lockouts on one of the domain admin accounts.
Question by:brent4257
1 Comment

Accepted Solution

brent4257 earned 0 total points
ID: 23615742
I discovered auditing can also be configured locally even on a domain controller. Once I turned off the domain and domain controller policy the local policy kicked in. It was configured by a previous admin and unknown to anyone. The policy had all auditing turned on thus the huge increase in events. By running gpedit.msc on the DC I was able to disable all the auditing and thus review the security logs. All DCs had to be examined this way to prevent any further incidents. Once this was done we reset the domain and domain controller audit policy back. Additionally we used ADSIedit and discovered on the security of the domain, configuration, and schema partitions that auditing had be set. Logs are now back reporting normally.

Featured Post

Free Tool: Port Scanner

Check which ports are open to the outside world. Helps make sure that your firewall rules are working as intended.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

SHARE your personal details only on a NEED to basis. Take CHARGE and SECURE your IDENTITY. How do I then PROTECT myself and stay in charge of my own Personal details (and) - MY own WAY...
In a recent article here at Experts Exchange (http://www.experts-exchange.com/articles/18880/PaperPort-14-in-Windows-10-A-First-Look.html), I discussed my nine-month sandbox testing of the Windows 10 Technical Preview, specifically with respect to r…
This Micro Tutorial will teach you how to add a cinematic look to any film or video out there. There are very few simple steps that you will follow to do so. This will be demonstrated using Adobe Premiere Pro CS6.
In a question here at Experts Exchange (https://www.experts-exchange.com/questions/29062564/Adobe-acrobat-reader-DC.html), a member asked how to create a signature in Adobe Acrobat Reader DC (the free Reader product, not the paid, full Acrobat produ…
Suggested Courses

807 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question