too many "successful logon" events?

[bustamove]

Hi,

We have a print server that receives a lot of "Successful Network Logon" (type 3) event logs, almost every second. They all from the same three computers only out of 500 PCs. Each of them initiate this message more than 15,000 per day.

netstat -o shows the process that's doing this is SVCHOST.EXE. Is this a known issue? I want to know why they are doing this? THanks

 

[Stevehewitt]

What's the text in the events?




Steve.

"They have the internet on computers now!" - Homer Simpson

 

[bustamove]

Looks like this:

Successful Network Logon:
User Name: <those 3 logon users>
Domain: XXX
Logon ID: (0x0,0x17721CDD)
Logon Type: 3
Logon Process: Kerberos Authentication
Package: Kerberos
Workstation Name: <those 3 workstation names>
Logon GUID: {59fea2b0-5447-ba7d-da12-4318da945db8}
Caller User Name: -
Caller Domain: -
Caller Logon ID: -
Caller Process ID: -
Transited Services: -
Source Network Address: <those 3 workstation IP addresses>
Source Port: <starts randomly, increment by 1>


All windows XP w/ latest patches.
Print server is W2K3

Thanks

 

[djtech2k]

It sounds like increased auditing on that machine. I would turn back auditing and see what happens.

 

[bustamove]

i always have the auditing on, and this is not happening to other 500 computers. i don't quite understand the reason to turn off the auditing logs, the size doesn't bother us, but i am afraid of these constant connection may slow down the performance

 

[djtech2k]

Check the machines having the problem for increased logging. Maybe these machines are cranked up a bit.

As for the burden, event logging can be a HUGE drag on a system with lots of traffic.

 

[bustamove]

thanks. but the computers are free of virus and adware according to scan result. computer are freshly installed w/patches and users have no admin rights.

one common thing i found is that they all have locally installed printer / drivers and the server is print server.

it is not really a big thing now, but i am afraid if all 500 pcs start to do this (say on some other servers), it will be very bad with or without event logging.

i really hope it will not happen to all because i dont know how to stop it.