Why so many logon/logoff events in the Security Log?

[TigerDivision]

I am looking at our security event log and looking at my particular network account I see numerous logon/logoff events in the log. Is this normal? I only log on once in the morning and log off in the evening. It's the same for other users. I wish someone would shed some light on this.

Thanks!

 

[monsterjta]

Users, machines, services, etc...all security related events will be logged in the event viewer if the policy is configured to log it. If you don't want to see it, stop logging it within the local or group policy.

Hope This Helps,

Good Luck!

 

[sparkbyte]

Yes this is normal activity in the event logs. As noted earlier things like system services and normal network browsing will cause multiple logon/logoff events.

Users, machines, services, etc...all security related events will be logged in the event viewer if the policy is configured to log it.

Also, if you haven't noticed yet, in your auditing settings there are 2 different types of logon/logoff events that are audited. If you have specific Event ID's your curious about MS has some good information on Events and auditing in their 2003 server security white papers.

Hope this helps.



Thanks

John Fuhrman
Titan Global Services

http://www.titangs.com