You could turn on "Audit Process Tracking" auditing for success and by observing the pattern you might see what it is. Be aware that setting can be rather noisy so watch your security logs closely for a while. Probably system so it may not show you too much.
I would look at bitsadmin to see what jobs are running when it happens, that should give you a clue what it is. Bitsadmin /monitor might be just the ticket..play around with the help, there are lots of options From: David Lum [mailto:[email protected]] Sent: Friday, June 19, 2009 1:07 PM To: NT System Admin Issues Subject: BITS I have a file/print/WSUS server that was using a lot of bandwidth across my WAN. I stopped WSUS and Automatic Updates and that had no effect, Stopping BITS did kill the traffic. Weird thing is 4 minutes alter the BITS process was started by SYSTEM 9but the traffic did flood not resume), but the event log gives no other clues. Looking at the services I see no services that are dependent on BITS. Would IIS auto-start the BITS service? Is there any way to find out what process *IS* starting that service? David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
