infranetsupport
asked on
Event Viewer being flooded with success logs
My backup DC Win 2000 box is being inundated with success login event logs from workstations. Getting dozens a second over many times during the day. I believe this has just started because my SQL server also seems to be slower than usual. Ran a network virus scan but nothing picked up. Any ideas?
If your backup dc is what everyone is using for authentication then you will see this.
You can turn off the success logs if you don't want to see them by right clicking the security log in eventviewer and then choosing filter and unchecking success audit.
With SQL and Outlook and anything else clients will authenticate constantly with your dc. That would give you success logs assuming everything is working like it should.
You can turn off the success logs if you don't want to see them by right clicking the security log in eventviewer and then choosing filter and unchecking success audit.
With SQL and Outlook and anything else clients will authenticate constantly with your dc. That would give you success logs assuming everything is working like it should.
ASKER
I dont want to remove the successful logins, i suspect there is an issue. what would cause my server to log so many audits, like 30, in a second?
Is there any more information in the event entry, which workstation, which user, etc?
If they all point to one user then that could be an issue. If it is multiple users and workstations it could be any number of things. You should try and see if you can limit your scope and find similarities in all the messages.
ASKER
Ive narrowed it down to two users but they are thin clients that login into citrix. all the event log messages are simple successful login messages for one user to a workstation.
ASKER
It seems like the logins keep happening over and over again all day long.
Is the workstation having a connection issue or does it have any software on it that may try to authenticate constantly.
ASKER
THe workstations are thin clients and i believe wouldnt work very well at all if connection was at all lost. there is no special software running that would authenticate a lot. The TS clients all pretty much access a SQL server.
If the sql database is using windows authentication they could authenticate each time they try to access a table or any part of the database.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Open the default domain controller policy, navigate to Computer Configuration / Windows Settings / Security Sttings / Local Policy / Audit Policy and change the audit account logon events entry.