Non stop event id

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

One fo the DC (2003) keep generating event id 538, 540 & 576.
This caused the security event log full in 3 minutes .


Any way to check which service keep generating the 3 events ?
 
Hello DD,

Check your domain controllers policy for Auditing configuration:

Audit logon events: 538 unsuccesfull logon 540 succesfull logon

576 audit privilege use

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
 
Back
Top