XP user filling NT security log

[kburrill]

I've searched for help on this without any success so far. We have an XP (home) user who fills the NT 4.0 (SP6a) server's security log every day. Every 15-20 seconds, there is both an event 528 and 538 for this one user (the two events almost always come in pairs). I've checked to see what programs are running on her machine; usually it is just outlook 2000 and a database program, both accessing files on a different computer (not the NT server). She doesn't have any network drives mapped. We have other XP (home & pro) users on the network who run the same two programs and only have a couple of 528 & 538 logs a day. I haven't been able to find any settings that differ between her and the other users. Any help would be appreciated - I've increased the size of the log file, but we're still sometimes filling it up before I can clear it.

 

[Grenage]

Well 528 is a successful log-on, and 538 is a successful log-off.

Does this machine have anything in it's own event log which occurs every few minutes ?

 

[kburrill]

Thanks for the tip.

I did a quick check of the XP computer's security, system, and application logs, but I didn't see any entries in the logs that were occurring as frequently as in the NT logs. I'll look through the logs more carefully tomorrow when the employee isn't here.