Security Events You Can Safely Ignore
Well as a System Administrator you browse through literal 100.000 event logs every week. Below you will find a list posted by Microsoft. This list tells you which events you can safely ignore. This will make your life a bit easier.... (I hope) You can find the original document here Event IDs Occurrence Comments 538 User logoff This event does not necessarily indicate the time that the user stopped using the computer. For example, if the user turns the computer off without first logging off, or if the network connection to a share breaks, the computer might not record a logoff at all, or might record a logoff only when the computer notices that the connection is broken. 551 User initiates logoff Use Event 538, which confirms logoff instead. 56...