I recently installed a Windows 2003 Standard Server (DC).
A couple of days after I installed it, I installed SP1
Other than Active Directory and DNS, there are NO other
applications / services installed (e.g. IIS, DHCP, SQL Server, etc.)

All seems well, except for the Security Log in Event Viewer.
There are thousands of Logon events! And they are all
succesful. No errors or warnings at all.

Every minute there are anywhere from 3 to 9 Logon Events.
They are always the same Event IDs... 538, 540, 576.
Over and over again. The user for almost all the events is System.
I just cleared it 2 days ago, and I now have over 10,000 entries
in the Security log.

Note: This is not a production server. It is in a test environment,
so there are no users actually logging in and using it.

What is Windows doing that it needs this many logins?
Also, prior to installing SP1, this was not happening.

Thanks.

Never mind. I found the problem. By default, Audit Logon Events,
in the Default Domain Controller Security Settings, is turned on. Once
I turned that off, the 10,000 messages stopped.




"RJ" <jackbobNOSPAM@hotmail.com> wrote in message news:uZGqnovLGHA.420@tk2msftngp13.phx.gbl...