Solved

Event Viewer being flooded with success logs

Posted on 2010-09-10
11
419 Views
Last Modified: 2012-05-10
My backup DC  Win 2000 box is being inundated with success login event logs from workstations. Getting dozens a second over many times during the day.  I believe this has just started because my SQL server also seems to be slower than usual. Ran a network virus scan but nothing picked up.  Any ideas?
0
Comment
Question by:infranetsupport
  • 4
  • 4
  • 2
  • +1
11 Comments
 
LVL 1

Expert Comment

by:Alginald
ID: 33645975
Remove the auditiing of successful logins in auditing in the default domain controller group policy.
Open the default domain controller policy, navigate to Computer Configuration / Windows Settings / Security Sttings / Local Policy / Audit Policy and change the audit account logon events entry.
0
 
LVL 10

Expert Comment

by:duffman76
ID: 33646001
If your backup dc is what everyone is using for authentication then you will see this.  

You can turn off the success logs if you don't want to see them by right clicking the security log in eventviewer and then choosing filter and unchecking success audit.

With SQL and Outlook and anything else clients will authenticate constantly with your dc.  That would give you success logs assuming everything is working like it should.
0
 

Author Comment

by:infranetsupport
ID: 33646002
I dont want to remove the successful logins, i suspect there is an issue. what would cause my server to log so many audits, like 30, in a second?
0
NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

 
LVL 1

Expert Comment

by:Alginald
ID: 33646042
Is there any more information in the event entry, which workstation, which user, etc?
0
 
LVL 10

Expert Comment

by:duffman76
ID: 33646224
If they all point to one user then that could be an issue.  If it is multiple users and workstations it could be any number of things.  You should try and see if you can limit your scope and find similarities in all the messages.
0
 

Author Comment

by:infranetsupport
ID: 33646249
Ive narrowed it down to two users but they are thin clients that login into citrix.  all the event log messages are simple successful login messages for one user to a workstation.
0
 

Author Comment

by:infranetsupport
ID: 33646475
It seems like the logins keep happening over and over again all day long.
0
 
LVL 10

Expert Comment

by:duffman76
ID: 33647503
Is the workstation having a connection issue or does it have any software on it that may try to authenticate constantly.  
0
 

Author Comment

by:infranetsupport
ID: 33675467
THe workstations are thin clients and i believe wouldnt work very well at all if connection was at all lost. there is no special software running that would authenticate a lot. The TS clients all pretty much access a SQL server.
0
 
LVL 10

Expert Comment

by:duffman76
ID: 33676370
If the sql database is using windows authentication they could authenticate each time they try to access a table or any part of the database.  
0
 
LVL 4

Accepted Solution

by:
HRL earned 500 total points
ID: 33758628
This may be a setting on the Citrix machines called session sharing. check out the following link for advice on forcing session sharing effectively.

http://support.citrix.com/article/CTX118579
0

Featured Post

Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Adding Computers to AD groups through an SCCM Task Sequence
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

832 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question