Many Logon/Logoff Entries

Our server security logs are FULL of successful logons (event 540) and
logoffs (event 538) happening all throughout the day and night for all
users. Is this normal Kerberos activity? (see below for log entries)

***********************
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 5/6/2005
Time: 10:25:12 AM
User: Domain\lsmith
Computer: SERVER
Description:
User Logoff:
User Name: lsmith
Domain: Domain
Logon ID: (0x0,0x24E093D)
Logon Type: 3



Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 5/6/2005
Time: 11:47:55 AM
User: Domain\lsmith
Computer: SERVER
Description:
Successful Network Logon:
User Name: lsmith
Domain: Domain
Logon ID: (0x0,0x28C925E)
Logon Type: 3
Logon Process: Kerberos
Authentication Package: Kerberos
Workstation Name:
Logon GUID: {cce2d6cf-d315-c221-8431-6d670e012994}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: [User's Workstation IP Address]
Source Port: 2653


--
Brandon Smith
IT Director
Presentations Direct - Specialized Office Equipment & Supplies
http://www.presentationsdirect.com


.

Relevant Pages