General discussion

Locked

Terminal Server Security Log

By garywag ·
Out Windows NT 4.0 Terminal Server at times reboots when a user logs out. The Security Log displays 'Event ID 578', Type 'Failure Audit', Category 'Privilege Use'.

Question One: How do we turn the logging off in Security? Thie server is in a domain where none of the other servers are logging events on Security.
Question Two: Is there a fix or work around for this problem?

Thank You

This conversation is currently closed to new comments.

2 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Terminal Server Security Log

by Joseph Moore In reply to Terminal Server Security ...

Well, auditing is turned on from User Manager, so open it on the TS server and click Policies -> Audit. Uncheck the Failure Logon and Logoff checkbox.

Now as for the reboot the server does, I am not sure, but I am gonna take a guess. Open Regeditand go to:
Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Control\LSA
Look for:
Name: CrashOnAuditFail
Type: REG_DWORD
Value: 1

If it is set to 1, change it to 0. The CrashOnAuditFail entry will force NT to reboot when the security log is full.

Collapse -

Terminal Server Security Log

by Joseph Moore In reply to Terminal Server Security ...

Actually I just checked something. IF you have CrashOnAuditFail set to 2, you can just delete the entire entry. Don't set it to 0. Just delete. Then reboot.

Back to Windows Forum
2 total posts (Page 1 of 1)  

Related Discussions

Related Forums