Logon (4624) events every three seconds RRS feed

  • Question

  • I am seeing logon events (EventID 4624 or Error Code: 0x0) every 3-4 seconds from our domain controllers.  The LogonType is either empty or Windows: Network, and the logon process is typically empty or Kerberos (rarely NtLmSsp or AdvAPI).  My best guess is that ActiveSync is triggering this behavior in attempting to sync mailboxes to mobile devices.  Is that a probable source?  If so, what steps can be taken to reduce the noise in our log monitors from these events?
    Thursday, December 17, 2015 7:52 PM