I have noticed this problem before, but never really addressed it, but it appears that our Event Viewer Security log is working overtime (W2K3 SBS configured as DC & File Server). It seems every few seconds it polls logon/logoff activity. According to the logs, it looks like the users are logging on and off every few seconds. Of course this is not happening. Is there any thoughts on why this is happening, or anyway to prevent this from happening so frequently?
It appears that there is a combination of Event ID 540, 576 and 538. Searching these ID numbers doesnt seem to produce very usefull results. Even in looking at this forum, I see specifically two others (thread931-992003 and thread931-673690) with similar problems that went unasnwered. Is this a commonly accepted "quirk" of W2K3 that everyone just deals with? How does one ever find an issue when one occurs in the security logs if this is the case? THere are litterally tens of thousands of entries.
It appears that there is a combination of Event ID 540, 576 and 538. Searching these ID numbers doesnt seem to produce very usefull results. Even in looking at this forum, I see specifically two others (thread931-992003 and thread931-673690) with similar problems that went unasnwered. Is this a commonly accepted "quirk" of W2K3 that everyone just deals with? How does one ever find an issue when one occurs in the security logs if this is the case? THere are litterally tens of thousands of entries.
