Solved

How to disable logon/logoff auditing for windows server 2003

Posted on 2013-02-07
7
1,100 Views
Last Modified: 2013-02-07
Please see the attachment. My server security log is flooded with logon/logoff events. I must of turned this on a while back and I can't see where to turn it off now. I have checked the default domain controller security settings and default domain security settings but everything is set to not defined. Where can I disable this event logging?

Thanks,

Justin
0
Comment
Question by:JustinGSEIWI
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
7 Comments
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 334 total points
ID: 38864379
In group policy - computer settings - local policies - security go to the auditing section.

Disable account logon auditing.
0
 

Author Comment

by:JustinGSEIWI
ID: 38864423
I checked that setting for each GP. They are all set to not defined. Is there a way I pull up which policy is causing the audit?
0
 

Author Comment

by:JustinGSEIWI
ID: 38864444
If I do an RSOP on the DC, it says not defined when I look up the audit policy for account logon.
0
Is Your DevOps Pipeline Leaking?

Is your CI/CD pipeline a hodge-podge of randomly connected tools? You’ve likely got a tool to fix one problem & then a different tool to fix another, resulting in a cluster of tools with overlapping functionality. Learn how to optimize your pipeline with Gartner's recommendations

 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 166 total points
ID: 38864498
In addition when you go to the audit settings you will see

"Audit Account Logon events"
"Audit Logon events"

It is confusing why they named them so similar but more info here

http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447934.aspx

Thanks

Mike
0
 

Author Comment

by:JustinGSEIWI
ID: 38864556
That setting is also set to not defined.

Thanks,

Justin
0
 
LVL 70

Accepted Solution

by:
KCTS earned 334 total points
ID: 38864662
Not defined does not mean its not going to happen - you need to set it to DISABLED
0
 

Author Closing Comment

by:JustinGSEIWI
ID: 38864829
Thank you!
0

Featured Post

Comparison of Amazon Drive, Google Drive, OneDrive

What is Best for Backup: Amazon Drive, Google Drive or MS OneDrive? In this free whitepaper we look at their performance, pricing, and platform availability to help you decide which cloud drive is right for your situation. Download and read the results of our testing for free!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Unable to Get RDP Certificate via Template 6 39
GPO denied - but why ? 6 57
DNS Record Manupluation 11 45
Really confused about group policies 5 33
This article runs through the process of deploying a single EXE application selectively to a group of user.
This article outlines the process to identify and resolve account lockout in an Active Directory environment.
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …
Are you ready to implement Active Directory best practices without reading 300+ pages? You're in luck. In this webinar hosted by Skyport Systems, you gain insight into Microsoft's latest comprehensive guide, with tips on the best and easiest way…

710 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question