|
Posted by jkeiser on October 2, 2007, 2:34 pm
Please log in for more thread options I am getting the same 2 (538 & 540) and the antivirus server will not let the
clients update because the server is 'too busy'. Is this a possible DoS
attack?
"Roger Abell [MVP]" wrote:
> It appears from the events given that a machine named
> USGS0001 in the domain named SG is doing a network
> logon (type 3) such as for access to a share, i.e. some
> application/service on that machine that is running in the
> System or the Network Service context is doing so.
>
>
> > One of the windows 2003 DC keep generating the 3 security event (EVENT id
> > 538,540 & 576)
> >
> > The security event log full after 3-5 minuts.
> >
> > Not sure which application or services keep generating the security event,
> > please help
> >
> >
> > event id :538
> >
> > User Logoff:
> > User Name: USGS0001$
> > Domain: SG
> > Logon ID: (0x0,0x75595CB)
> > Logon Type: 3
> > Event id 540
> > Successful Network Logon:
> > User Name: USGS0001$
> > Domain: SG
> > Logon ID: (0x0,0x75595CB)
> > Logon Type: 3
> > Logon Process: Kerberos
> > Authentication Package: Kerberos
> > Workstation Name:
> > Logon GUID:
> > Caller User Name: -
> > Caller Domain: -
> > Caller Logon ID: -
> > Caller Process ID: -
> > Transited Services: -
> > Source Network Address: 10.192.100.2
> > Source Port: 1818
> >
> > Event id 540
> >
> > Special privileges assigned to new logon:
> > User Name: USGS0001$
> > Domain: SG
> > Logon ID: (0x0,0x75595CB)
> > Privileges: SeSecurityPrivilege
> > SeBackupPrivilege
> > SeRestorePrivilege
> > SeTakeOwnershipPrivilege
> > SeDebugPrivilege
> > SeSystemEnvironmentPrivilege
> > SeLoadDriverPrivilege
> > SeImpersonatePrivilege
> > SeEnableDelegationPrivilege
> >
> > For more information, see Help and Support Center at
>
>
>
| 
XML Sitemap