Windows Forum

Ask something
Discussion Locked

Event Logging - System User

0 helpful
3 replies

by badfish

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
When auditing file/object access is there anyway to not audit what the system touches? The system user is quickly filling up my log space every day. I don't think I should be concerned with auditing what the system accesses should I? I don't have the "everyone" group specified to audit in any of the directories on the server just custom global groups I have created. Thanks

3 replies

by evilthor

the only way that you have system user logs is if you have added it somehow. try this. go to a file or folder you are auditing and right click then on security tab click auditing to get to the users and groups window.click add. under the add names box see if SYSTEM is there along with your custom global groups. if so eliminate it.

by badfish

Thanks, but I double-checked all my folders and who exactly I am auditing. I am only specifying a global group that I created that contains only created user accounts. I am only auditing "File and Object Access" however I get an Event ID: 562 for every Event ID: 560 which specifies the user. These 562 events give the user as NTAUTHORITY\SYSTEM. I would love to get rid of the 562 events as they really don't tell me anything and are causing my log files to fill up twice as fast. Thanks

This discussion is closed to new replies.