Logon / Log Off Events Over Taking Log File on Server

[Ravenrx7]

User Logoff:
User Name: Administrator
Domain: xxxxx
Logon ID: (0x0,0x19FACAE1)
Logon Type: 3
Event ID 538

I'm getting tons of these ID's for logon/log off on the server on the domain. There are shared folders on the server. How can I reduce this?

Josh McMahon
A+ Certified,CCNA
sold@joshmcmahon.com

 

[ShackDaddy]

In either the Local Security Policy or the Default Domain Controller Security Settings (both are in the Admin Tools menu area) go into Security Settings -> Local Policies -> Audit Policy. Open up "Audit account logon events" if it is defined and uncheck the "success" checkbox. If it isn't defined, then it's defined somewhere else, so check the other policy settings area. That will stop logon success auditing.

Or you could just make your log file larger and use the Filter option when you are searching it to narrow your searches to what you want. That way you retain your access log in case it could come in handy.

ShackDaddy