IT Employment

Ask something
Discussion Locked

NT Backup causing unusual security log e

0 helpful
3 replies

by navy moose

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am supporting a PDC with twenty five clients. We run full backups twice a week.

As I review the security logs each day, I notice entries during backups indicating administrator logons and logoffs during the time the backup was running. The server is locked when I am not using it and I find it very surprising to see these kind of entries.

Other entries I see involve permissions changed directly related to the backup and these do not concern me greatly.

I have showed these logs to other administrators at our various offices and they did not understand them either.

I checked technet and the resource kit without finding out anything.

I was hoping somebody here might have seen entries similar to what I am describing and could possibly explain them.

Thank you for your assistance,

3 replies

by goobs

It sounds like the administrator account was configured as the account used for server backups. I usually set up an account specifically for backups. Give it the rights for backup only. It is not actually physically logging onto the system, it isdoing it "behind the scenes".

by navy moose

You're correct, the administrator account is the only one configured to perform backups.

I knew the system wasn't actually logging and logging out, but I didn't know there would be a behind the scenes activity like this.

Lemee see if I get this right. The backup account is virtually logging in and logging out during the backup, and this explains the activity I am seeing.

Please let me know if my summary is incorrect. Thank you for taking the time to respond to my query.

This discussion is closed to new replies.