|
Posted by Meinolf Weber on October 2, 2007, 2:44 pm
Please log in for more thread options
Hello jkeiser,
Like Roger Abell wrote, it is normal behavior. Check the Default domain
controller
policy for seetings of auditing from Success and failures for object access,
etc. If you will stop the logging you have to set it here.
Best regards
Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
> I am getting the same 2 (538 & 540) and the antivirus server will not
> let the clients update because the server is 'too busy'. Is this a
> possible DoS attack?
>
> "Roger Abell [MVP]" wrote:
>
>> It appears from the events given that a machine named
>> USGS0001 in the domain named SG is doing a network
>> logon (type 3) such as for access to a share, i.e. some
>> application/service on that machine that is running in the
>> System or the Network Service context is doing so.
>>
>>> One of the windows 2003 DC keep generating the 3 security event
>>> (EVENT id 538,540 & 576)
>>>
>>> The security event log full after 3-5 minuts.
>>>
>>> Not sure which application or services keep generating the security
>>> event, please help
>>>
>>> event id :538
>>>
>>> User Logoff:
>>> User Name: USGS0001$
>>> Domain: SG
>>> Logon ID: (0x0,0x75595CB)
>>> Logon Type: 3
>>> Event id 540
>>> Successful Network Logon:
>>> User Name: USGS0001$
>>> Domain: SG
>>> Logon ID: (0x0,0x75595CB)
>>> Logon Type: 3
>>> Logon Process: Kerberos
>>> Authentication Package: Kerberos
>>> Workstation Name:
>>> Logon GUID:
>>> Caller User Name: -
>>> Caller Domain: -
>>> Caller Logon ID: -
>>> Caller Process ID: -
>>> Transited Services: -
>>> Source Network Address: 10.192.100.2
>>> Source Port: 1818
>>> Event id 540
>>>
>>> Special privileges assigned to new logon:
>>> User Name: USGS0001$
>>> Domain: SG
>>> Logon ID: (0x0,0x75595CB)
>>> Privileges: SeSecurityPrivilege
>>> SeBackupPrivilege
>>> SeRestorePrivilege
>>> SeTakeOwnershipPrivilege
>>> SeDebugPrivilege
>>> SeSystemEnvironmentPrivilege
>>> SeLoadDriverPrivilege
>>> SeImpersonatePrivilege
>>> SeEnableDelegationPrivilege
>>> For more information, see Help and Support Center at
>>>
| 
XML Sitemap