Daily IT Matters, this is the place where I post my daily findings on IT.

Friday, July 25, 2008

Security Events You Can Safely Ignore

Well as a System Administrator you browse through literal 100.000 event logs every week.
Below you will find a list posted by Microsoft. This list tells you which events you can safely ignore.

This will make your life a bit easier.... (I hope)

 

You can find the original document here

 

Event IDs Occurrence Comments

538

User logoff

This event does not necessarily indicate the time that the user stopped using the computer. For example, if the user turns the computer off without first logging off, or if the network connection to a share breaks, the computer might not record a logoff at all, or might record a logoff only when the computer notices that the connection is broken.

551

User initiates logoff

Use Event 538, which confirms logoff instead.

562

A handle to an object closed

Always records a success.

571

Client Context deleted by Authorization Manager.

Normal where Authorization Manager is in use.

573

Process generates nonsystem audit event with Authorization Application Programming Interface (AuthZ API)

Typical behavior.

577

578

Privilege service called, privileged object operation

These high volume events typically do not contain enough information either to understand what happened or to act upon them.

594

A handle to an object was duplicated

Typical behavior.

595

Indirect access to an object was obtained

Typical behavior.

596

Backup of data protection master key

Occurs automatically every 90 days with default settings.

597

Recovery of data protection master key

Typical behavior.

624

642

Event 624 where User equals System, followed by 642 where Target Account Name equals IUSR_machinename or IWAM_machinename and Caller User Name equals machinename$ .

This event sequence indicates that an administrator has installed IIS on the computer.

624

630

642

User equals System and all three events have same time-stamp and New/Target Account Name equals HelpAssistant and Caller User Name equals DCname$

This sequence is generated when an administrator installs Active Directory on a computer that runs Windows Server 2003.

624 or

642

User equals ExchangeServername$ and Target Account Name is a Globally Unique Identifier (GUID)

This event occurs when an Exchange Server first comes online and automatically generates system mailboxes.

624

Caller User Name is any user and New Account Name is machinename$

A user in the domain has created or connected a new computer account in the domain. This event is acceptable if users have the right to join computers to a domain; otherwise you should investigate this event.

627

User equals System and Target Account Name equals TsInternetUser and Caller User Name is usually DCname$

These events result from the normal behavior of a computer that runs Terminal Services.

672

Kerberos AS Ticket request

If you collect logon events 528 and 540 from all computers, event 672 might not contain any additional useful information, as it just records that a Kerberos TGT was granted. There must still be a service ticket granted (event 673) for any access to occur.

680

Account Logon

If you collecting logon events 528 and 540 from all computers, event 680 might not contain any additional useful information, because it just records validation of the account credentials. A separate logon event records what the user accessed.

697

Password policy checking API called

Typical behavior.

768

Forest namespace collision

Not security related.

769

770

771

Trusted forest information added, deleted or modified

These events indicate normal operation of inter-forest trusts. You should not confuse these with addition, deletion, or modification of the trust itself.

832 to 841

Various Active Directory replication issues

No security implications.

No comments:

Google