Many 540/538 events during short period of... Expand / Collapse
Posted 1/25/2010 4:19:12 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 1/25/2010 4:01:52 AM
Posts: 1, Visits: 2

I wonder why are there so many 540/538 entries (each 540/538 pair with the same logon id) during so short period of time? It is even twice per second and is related to many users and workstations accounts.

Besides from time to time some users (WinXP/Vista) can't login to AD. There is no strict rule - each time that problem is related to different users accounts.

Thanks for your precious explanations/help

Does anyone knows how to paste attachments here?

  Post Attachments 
538_540.JPG (4 views, 87.18 KB)
Post #300
Posted 3/10/2010 5:30:17 PM


Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 329, Visits: 0
This is one of the ugly secrets of the Windows security log.  It makes auditing network logons to file servers basically impossible.  As soon as you finish using a shared file and close it, Windows server terminates your network logon session.  Then as soon as you access some other file or folder on the server, your client computer establishes a new logon session.  Hence 540,538,540,538,540,538,540,538,540,538,540,538,540,538...
Post #325
« Prev Topic | Next Topic »

Permissions Expand / Collapse

All times are GMT -5:00, Time now is 1:42pm