asked on

Event ID 576 - Where is this account loggin on from?

My organization has a user that left, and their account is continually logging on to one of our machines machines with a privledge use category. This was a trusted person, and they are not in fact logging on any longer. If we disable the account we get a slew of failure aduits in the security log. We are trying to find out where the logon call is being initiated from so we can fix that and move on. It apprears to be restarting the WMI perfomance adapter service.

I have disabled SMS agents, checked for AT schedules, Windows Scheduler, and performance counters. I cannot find anything... help!

SOLUTION

btrivett

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

ASKER CERTIFIED SOLUTION

Tapan Pattanaik

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

Hay_Seed

ASKER

Thanks for the links, however, I know how to disable the auditing, but im trying to locate the Root Cause of this event, so I can make changes and be able to disable this user account and not have to get a slew of failed audits.

Hay_Seed

ASKER

Update,
I am getting Events 540, 576, 540 and 538 from this user. just trying to find out whats causing it, so I can disable it.

SOLUTION

Tapan Pattanaik

membership

Create a free account to see this answer

Signing up is free and takes 30 seconds. No credit card required.

See answer

SOLUTION

btrivett

membership