security log events
- From: "L." <nic>
- Date: Wed, 19 Oct 2005 00:11:53 +0200
Is it normal to have security log on our Windows 2003 server (acting as a
domain controller) flooded with the following events? Every 2 to 4 minutes I
get about 15 events.
-------------------------------------------
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 576
Date: 18.10.2005
Time: 5:00:25
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Special privileges assigned to new logon:
User Name: SERVER$
Domain: MYDOMAIN
Logon ID: (0x0,0xE6B96F)
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeEnableDelegationPrivilege
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 18.10.2005
Time: 5:00:25
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
Successful Network Logon:
User Name: SERVER$
Domain: MYDOMAIN
Logon ID: (0x0,0xE6B96F)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {67611579-f981-5e9d-8f0e-5624639cab45}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: 192.168.1.251
Source Port: 0
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 18.10.2005
Time: 5:00:36
User: NT AUTHORITY\SYSTEM
Computer: SERVER
Description:
User Logoff:
User Name: SERVER$
Domain: MYDOMAIN
Logon ID: (0x0,0xE6B96F)
Logon Type: 3
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
-------------------------------------------
.
- Prev by Date: MS05-050 and Service Pack 1
- Next by Date: Re: Logon script does not run randomly
- Previous by thread: MS05-050 and Service Pack 1
- Next by thread: Re: security log events
- Index(es):
Relevant Pages
|
|