Forum

Ultimate Windows Security Forum » Security Log » 540 - Successful Network Logon » Multiple event 540 and 538 entries

Multiple event 540 and 538 entries Expand / Collapse
Rate Topic
Display Mode
Topic Options
Author
Message
netwit
Posted 9/28/2009 9:52:16 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/28/2009 1:15:25 PM
Posts: 2, Visits: 1
What would cause one user to fill the event log on my domain server with event 540 and 538 entries?  I am talking over 1 million in 24 hours.  I can't detect any virus or spyware on the system and the system seems to run normally but only shutting off the user PC stops the stream of event losgs.
Post #218
RandyFranklinSmith
Posted 9/28/2009 10:16:30 AM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
Wow.  That's a good question.  You should normally see a few every 90 minutes or so as the workstation refreshes group policy.  can you send a sample of the 540 event? 

does it resume when you turn on the user's computer?  do you have to logon as the user for the problem to resume?

Post #219
netwit
Posted 9/28/2009 1:21:43 PM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 9/28/2009 1:15:25 PM
Posts: 2, Visits: 1
event stream resumes when user logs back in.  logging in on his PC as myself results in a few bursts of the same 540/538 pattern but looks normal.  I am not sure how to attach a sample of the event log to the forum--can you attach a file like an email attachment?
Post #220
RandyFranklinSmith
Posted 9/28/2009 2:17:43 PM
Expert

ExpertExpertExpertExpertExpertExpertExpertExpert

Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
you can just paste a copy of the event after copying it to your clipboard in Event Viewer.

I think you need to take a look at the processes running on the workstation after logging on as that user. 

The only native functionality scenario I can think of that may cause that to have is if Group Policy is configured to refresh constantly for that user.  if you need help locating the setting to which I refer let me know.

Post #221
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 10:03pm