Excessive Logon/Logoff items in SYSTEM event log

[mbuechler]

This post may be related to another issue that I'm facing (that I've posted in the forum) but I'm not sure. I need to know if there is a way to stop my workstations from constantly logging-on and off the domain controller every 15 minutes throughout the day. What service or process could be causing a machine to do this? I have events 538 and 540 successively entered into the System log on my server 2 to 6 times every 15 minutes from all of my workstations (four of time).

 

[ShackDaddy]

All sorts of things can create logon-logoff events. For example, if you have users with Outlook open, who then access public folders, that sends authentication requests. Even opening and closing Outlook sometimes does the same thing. Maintaining/accessing a mapped drive connection or sending a print job are other things that can do this.

Why are you worried about this? In my opinion it's like worrying about someone taking more breaths per minute than you'd originally planned; some activities just require more authentication.

If you are worried about your logs filling up, just make them bigger.

The more systems you have to manage, the less you care about any events that aren't alerts or errors.

ShackDaddy

 

[mbuechler]

I agree with your premise and wouldn't care - the issue is that within several seconds of these events, I temporarily loose my connection to the server and get delayed-write failures and programs like Quicken (that maintain open file connections) fail regularly. The errors always occur about the same time that these log-on/off events appear in the server's system log - I'm assuming there is some correlation ... ?