Windows Forum

Ask something
Discussion Locked

Terminal Server Security Log

0 helpful
2 replies

by garywag

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Out Windows NT 4.0 Terminal Server at times reboots when a user logs out. The Security Log displays 'Event ID 578', Type 'Failure Audit', Category 'Privilege Use'.

Question One: How do we turn the logging off in Security? Thie server is in a domain where none of the other servers are logging events on Security.
Question Two: Is there a fix or work around for this problem?

Thank You

2 replies

by joseph moore

Well, auditing is turned on from User Manager, so open it on the TS server and click Policies -> Audit. Uncheck the Failure Logon and Logoff checkbox.

Now as for the reboot the server does, I am not sure, but I am gonna take a guess. Open Regeditand go to:
Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Control\LSA
Look for:
Name: CrashOnAuditFail
Type: REG_DWORD
Value: 1

If it is set to 1, change it to 0. The CrashOnAuditFail entry will force NT to reboot when the security log is full.

by joseph moore

Actually I just checked something. IF you have CrashOnAuditFail set to 2, you can just delete the entire entry. Don't set it to 0. Just delete. Then reboot.

This discussion is closed to new replies.