Security Event Logs 538 540 576

[dre3]

I have a Windows 2003 Server, and the Security Event Log is being inundated with entries; 48,587 since 18:30 on 6/30/08. In each entry, the 'Type' is 'Success Audit', the 'Source' is 'Security', the 'Category' is 'Logon/Logoff', the 'Event' is either '538', '540', or '576'. They seem to be generating random 'User' values, and they occur over intervals from less than a second to as long as 5 seconds. None of these users are currently using the server, either logged on, remoting, or using applications.

Does anyone have any ideas? I have had some suggestions, but they are all things that do not apply to my problem.

 

[ITPangaeaArchitect]

ok this is your domain controller? logon/logoff events are tracked on DCs for any users logging onto the domain.

-Brandon Wilson
MCSE:Security00/03
MCSA:Messaging00
MCSA:Security03
A+