Re: Security event log messages 576/540/538
- From: "Mike Stem" <PSCCmdt@xxxxxxxx>
- Date: Wed, 11 May 2005 10:08:42 -0400
Nick,
I see your point. I just found this from an earlier post, looks like it
could do what you wish. Check it out:
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
This is the SBS default auditing level, and it's probably based on a
security best practice. IMO it makes the security log useless because you
can't separate the valuable entries from the sea of entries that don't
require attention.
To change this setting, on the server open Group Policy Management. In the
left pane under Domain Controllers, r-click the SBS auditing policy and
click Edit. Under Computer Configuration -> Windows Settings -> Security ->
Local -> Audit, see what's logging Success and Failure. Open that entry and
clear the check box for Success. (I'm not at the server so I don't have the
exact entry, but I think it's Audit Logon Events). You should see the
success entries stop shortly after changing the setting.
BTW, I recommend writing down the details any time you change a setting in
group policy, so that you can put it back if you get unintended results.
"Brandon" <bsmith@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:%23lYrSFXVFHA.1452@xxxxxxxxxxxxxxxxxxxxxxx
> Our server security logs are FULL of successful logons (event 540) and
> logoffs (event 538) happening all throughout the day and night for all
> users. Is this normal Kerberos activity? (see below for log entries)
"NickC" <NoSpam@xxxxxxxxxxxxxx> wrote in message
news:uDci7RhVFHA.3024@xxxxxxxxxxxxxxxxxxxxxxx
> Has anyone found a way to stop the flood of event messages 576/540/538
> from
> filling the security event log? I know they are only informational but
> they
> get in the way preventing other more important events from being noticed.
> Also they must use up some cpu time especially if the SBS$Monitoring
> service
> has to sift through them all.
> Nick
>
>
.
- References:
- Security event log messages 576/540/538
- From: NickC
- Security event log messages 576/540/538
- Prev by Date: Re: Exchange bandwidth consumption.
- Next by Date: Re: Backup problem Exchange mailboxes
- Previous by thread: Re: Security event log messages 576/540/538
- Next by thread: Software Disk Mirroring
- Index(es):
Relevant Pages
|
