Windows Forum

Ask something
Discussion Locked

Security Log in Event Viewer

0 helpful
6 replies

by willbewealthy

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a fairly simple network - a BDC & PDC both running NT 4.0 servicing a mixed environment of approximately 20 workstations (NT 4.0 & Win2k Pro). We run Netbui as our main protocol along with TCP/ip for internet access. - Very simple. Now - here's my question. I have been checking Event viewer on both the PDC & BDC. Obviously they both handle logons. On both my servers I'm noticing dozens of logons and logoffs for some users. Not only that - the time of these logons and logoffs is way off sometimes - even though the time on both of my servers is correct. Why am I seeing these multiple logons and logoffs - I know for a fact that my users are not logging on and off this many times. What is causing this? Is it the fact that their screensavers are password protected? This problem is driving me crazy - Please help!

6 replies

by timber

Do you force authentication for Internet? evrytime they go to the internet it would be a logon and when they exit IE or Netscape it would log them off. Just a thought...

The screensaver shouldn't have anything to do with it. That is controlledby the local machine.

I would also suggest going strictly to IP. 20 + users is almost to many to be running Netbeui. If your already running IP for the net it shouldn't be a big deal just to drop Netbeui all together.

Hope that helps....

by jason.barnett

This is to be expected. When a user logons on in the morning there will be a successful logon recorded in the validating Domain Controller. Later that day the user maps a network drive or opens a previously mapped network drive for the first time. A successful logon will be recorded. Therefore any netowrk activity will produce a security event where authentication of a users permissions are involved.

You would want to be worried if you weren't seeing multiple logons per day as it would mean that your users are all in the pub and have left you behind to worry about event logs!!

Cheers.

This discussion is closed to new replies.