none
logon logoff every 5 seconds RRS feed

  • Question

  • hello,

    i have a problem with a user, in the AD server in the event viewer in security appears every second 5 seconds the events 4634 and 4624(logon and logoff events)

    we change the computer of the user thinking that the problem could be his machine.... but the problems continue...

    now the user connects with wifi....(previuosly by ethernet)

    thanks

    Friday, May 4, 2012 5:42 PM

Answers

  • hello, 

    the problem was that the user has in outlook more than 500 objects... so i have to edit a key on the registtry

    • Marked as answer by exitista Tuesday, May 8, 2012 2:16 PM
    Tuesday, May 8, 2012 2:16 PM

All replies

  • hello,

    i have a problem with a user, in the AD server in the event viewer in security appears every second 5 seconds the events 4634 and 4624(logon and logoff events)

    we change the computer of the user thinking that the problem could be his machine.... but the problems continue...

    now the user connects with wifi....(previuosly by ethernet)

    thanks

    Hello,

    It is perfectly normal that you will have a big number of logged security events. See a similar thread: http://forums.techarena.in/small-business-server/743284.htm

    To avoid that, you can update your audit policy: http://technet.microsoft.com/en-us/library/cc787268%28v=ws.10%29.aspx


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.   

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Microsoft Certified Trainer

    Friday, May 4, 2012 6:36 PM
  • but the problem is only in one user.... logon and logoff every 5 seconds...
    Friday, May 4, 2012 8:12 PM
  • but the problem is only in one user.... logon and logoff every 5 seconds...

    Check the source of the logons and see if there any service or application running under his account from the source of the logons.


    This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.   

    Microsoft Student Partner 2010 / 2011
    Microsoft Certified Professional
    Microsoft Certified Systems Administrator: Security
    Microsoft Certified Systems Engineer: Security
    Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration
    Microsoft Certified Technology Specialist: Windows 7, Configuring
    Microsoft Certified Technology Specialist: Designing and Providing Volume Licensing Solutions to Large Organizations
    Microsoft Certified IT Professional: Enterprise Administrator
    Microsoft Certified IT Professional: Server Administrator
    Microsoft Certified Trainer

    Friday, May 4, 2012 8:20 PM
  • It seems that account is information is saved in some application,file/printer share or services,etc.You need to check the event log for more details you may get evidence for the same.Example in the event there will be logon type another parameter which will be helpful to track the same.Eg Logon Type 3 means Network logon.This is common if you have shared files/printers.

    Hope this helps


    Best Regards,

    Sandesh Dubey.

    MCSE|MCSA:Messaging|MCTS|MCITP:Enterprise Adminitrator | My Blog

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.


    Saturday, May 5, 2012 6:22 AM
  • Sometimes, it can be saved password in the mobile device or the account might be configured for the active sync triggering such events. The better way to handle this type of situation is either using Netmon/Wireshark tool to monitor from the the log off and log event is actually been triggered.Atleatst, using wireshark, you can come to know the source triggering such events.  It might be account is configured somewhere to run as a service for any application or saved for mapping drive.


    Awinish Vishwakarma - MVP - Directory Services

    My Blog: awinish.wordpress.com

    Disclaimer This posting is provided AS-IS with no warranties/guarantees and confers no rights.

    Saturday, May 5, 2012 8:08 AM
    Moderator
  • Have you tried to delete the user's profile to try again?

    If problem persists, I suggest you check the logon ID for both 4634 and 4624 events to make sure they are for the same logon session.  If their Logon IDs are the same, then, you can check the Logon Process and Logon Type for event 4624 to see which process originating the logon action and what's the logon type for more clues about the problem. 

    Please refer to http://msdn.microsoft.com/en-us/library/windows/desktop/aa380129(v=vs.85).aspx to see what are the logon types and what they are used for.

    Usually, there may be some schedule job or service run under the user account which may lead to such a problem, but these are not the only sources as Windows has API for developer to logon any user account at any time.

    Regards,

    Cicely


    Monday, May 7, 2012 7:05 AM
    Moderator
  • hello, 

    the problem was that the user has in outlook more than 500 objects... so i have to edit a key on the registtry

    • Marked as answer by exitista Tuesday, May 8, 2012 2:16 PM
    Tuesday, May 8, 2012 2:16 PM