September 5th, 2003, 04:35 PM
Hi I have been trouble shooting a program lagging real bad when I noticed a Whole Bunch of failure audits in the event viewer security logs in win xp. Here's where it gets interesting, the failure audit are occuring about 5 times a second, and it is still occuring. Now I did a netstat -ano and did not see any service accessing the network other than usual connection to the domain. I checked task manager and nothing is running other than normal system processes. I turned up nothing on a virus scan and zone alarm is not blocking anything at the moment. Does any one know what could be causing this and how to stop it?
September 5th, 2003, 04:37 PM
Failure audits for what event?
September 5th, 2003, 05:45 PM
Okay I figured out the problem. I had auditing turned on in the local security policies, and for audit privilage use I had specified success,failure. Since the user was not an administrator it was logging a failure because I was viewing the event viewer and did not have permissions to do so. I turned audit privilage use to no auditing and it stopped filling up my event viewer with failure audits for privilage use.