UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 540 - Successful Network Logon / Many 540/538 events during short period of time. / Latest Posts

RE: Many 540/538 events during short period of time.

RandyFranklinSmith — Wed, 10 Mar 2010 17:30:17 GMT

This is one of the ugly secrets of the Windows security log. It makes auditing network logons to file servers basically impossible. As soon as you finish using a shared file and close it, Windows server terminates your network logon session. Then as soon as you access some other file or folder on the server, your client computer establishes a new logon session. Hence 540,538,540,538,540,538,540,538,540,538,540,538,540,538...

Many 540/538 events during short period of time.

Pablo — Mon, 25 Jan 2010 04:19:12 GMT

Hello

I wonder why are there so many 540/538 entries (each 540/538 pair with the same logon id) during so short period of time? It is even twice per second and is related to many users and workstations accounts.

Besides from time to time some users (WinXP/Vista) can't login to AD. There is no strict rule - each time that problem is related to different users accounts.

Thanks for your precious explanations/help
Pablo

P.S.
Does anyone knows how to paste attachments here?