Excessive logon/logoff messages in event log

  • Thread starter Thread starter Kevin Porter
  • Start date Start date
K

Kevin Porter

I have SBS 2003 Premium. It's a new installation with only one machine
connected to it. I do have Veritas backup software loaded and ISA running.
SQL Server is installed but disabled. Exchange is installed and running.

In the event log, several times a minute, there are logon and logoff events
for the server name, server2$ (server name plus '$'), and the administrator
account, which I haven't renamed yet. The event IDs are 538, 576, and 540.

I realize that I can disable the logging of these events, but I would like
to log legitimate logons and logoffs of users. Is there something wrong in
the system that is causing this activity or is it considered "normal"?

I have looked around and did see another thread about this from September
but didn't see any solution posted other than just disabling the logging of
all of these events.

Thanks - Kevin
 
The 576 description did point me to this knowledge base article:

http://support.microsoft.com/?kbid=822774

It isn't clear whether this is my problem, but it does discuss a bug where
excessive audit events occur. Unfortunately it a hotfix that I would have
to pay for, even though I already just paid thousands of dollars for the
OS. I guess I should just live without the auditing.

Thanks for the response, Cary. The article was last updated yesterday
(12/4) so I'll keep an eye on it and see if any more information comes to
light.
 
Kevin,

Glad to be of assistance.

Cary

Kevin Porter said:
The 576 description did point me to this knowledge base article:

http://support.microsoft.com/?kbid=822774

It isn't clear whether this is my problem, but it does discuss a bug where
excessive audit events occur. Unfortunately it a hotfix that I would have
to pay for, even though I already just paid thousands of dollars for the
OS. I guess I should just live without the auditing.

Thanks for the response, Cary. The article was last updated yesterday
(12/4) so I'll keep an eye on it and see if any more information comes to
light.
Click to expand...
 
Back
Top