RE: [ISSForum] Logon_with_admin_privileges with no user name

[Bahaa Hudairi]

Hi ,   We have faced this issue and had thousands of events being logged daily. This is because the server sensor enables auditing on the server and gets its events from the event log. One other thing is that it's not possible to separate internal system access with admin privilege with network access with admin privilege, that’s why at the end you get lots of events.   ISS recommended removing this check so as to get rid of this event.   Regards,   Bahaa Hudairi Technical Consultant Elite Computer Solutions P.O. Box: 58915 Riyadh, 11515 Kingdom of Saudi Arabia http://www.elite.com.sa   Tel.: + (966 1) 472 5240 ext 56 Fax: + (966 1) 472 5245 Mobile: +966 (0)5 622 1897   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mohr James Sent: Wednesday, February 18, 2004 2:30 PM To: [EMAIL PROTECTED] Subject: [ISSForum] Logon_with_admin_privileges with no user name   Hi All!   We have a Windows 2000 machine with server sensor 7. We are regularly getting Logon_with_admin_privileges events in which the User Name is blank. Is this normal? Is there any way of determining which user it is? Any help is appreaciated.   Regards,   Jim Mohr   _______________________________________________ ISSForum mailing list [EMAIL PROTECTED]   TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo