Security log going mental

[KWestos]

My security log is going into overdrive - please see attached screen shot.

 

Anyone got any ideas. I think this is causing my machine to periodically lose network connections also

[sharkster]

getting hacked

[sharkster]

only joking don't have a clue what its doing :S

[Diello]

Seems you have Auditing set to report on everything! have you checked your Local Security Policy?

[KWestos]

I have just found out that it happens on all other machines too! Edited November 4, 2008 by KWestos

[KWestos]

Seems you have Auditing set to report on everything! have you checked your Local Security Policy?

 

Is this local security policy within active directory?

[SYNACK]

If it is happening on all machines that would indicate that it is probably a domain based policy, it will be under the computer config > windows settings > security settings > local policies > audit policies of one of your policies.

 

It may be quickest to run the RSoP snapin on the server or use the gp managment console to make a summary of all the policies that are appling and then see which of your domain policies is set to enable auditing

[KWestos]

If it is happening on all machines that would indicate that it is probably a domain based policy, it will be under the computer config > windows settings > security settings > local policies > audit policies of one of your policies.

 

It may be quickest to run the RSoP snapin on the server or use the gp managment console to make a summary of all the policies that are appling and then see which of your domain policies is set to enable auditing

 

Out of the 9 possible policy settings - which ones do you or others have set?

[KWestos]

I have now switched off all policy settings for auditing and I still get all the messages every 3 or 4 minutes - help!

[KWestos]

Having stopped all the auditing from active directory, I think I may have solved it. When I stopped them on AD the local policies kicked in and I forgot about these. I have stopped these logging for the time being and it seems to have sorted it. I will probably enable them one by one to get a good balance of logging audits.

 

What do other people use, i.e. which policies are set.

 

Jesus - I just realised the time. 22:45 - I've been logged in from home for 4 hours! what a sad git!