locked
Many events - Success Audit Event 552 RRS feed

  • Question

  • Hello,

    On one of our workstations, we are seeing many Event 552 events being logged. I understand what the purpose of these events are, but can someone explain a reason for which hundreds of these are being logged a day?

    Windows XP workstation.

    The events look like this:

    Event ID 552. Logged on User: jsmith   Domain:  KV   Logon GUID: {4201358b-c907-f3f0-9e79-6f49ae60b535}

    User whose credentials were used: JSMITH   Domain: KV.JV   Logon GUID: -

    Monday, August 5, 2013 5:00 PM

Answers

  • Well is the user running a program as a different user?  Such as Run As Administrator?  It is possible that they set the parameter in the shortcut to run as Administrator and anytime they run it, it creates this instance.


    Just throwing out some ifs to contemplate.

    Wednesday, August 7, 2013 10:48 PM
  • Can you create a new profile for the user and check? Also, delete any saved password in the OS, can be in IE, or other apps. 

    Arnav Sharma | Facebook | Twitter Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Thursday, August 8, 2013 3:40 AM
    Moderator

All replies

  • I still have not found an answer in research.
    Wednesday, August 7, 2013 5:36 PM
  • Well is the user running a program as a different user?  Such as Run As Administrator?  It is possible that they set the parameter in the shortcut to run as Administrator and anytime they run it, it creates this instance.


    Just throwing out some ifs to contemplate.

    Wednesday, August 7, 2013 10:48 PM
  • Can you create a new profile for the user and check? Also, delete any saved password in the OS, can be in IE, or other apps. 

    Arnav Sharma | Facebook | Twitter Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Thursday, August 8, 2013 3:40 AM
    Moderator
  • Any updates?

    Arnav Sharma | Facebook | Twitter Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Saturday, August 17, 2013 3:16 PM
    Moderator