Event ID 538 and 540 repeating continously..

[dawks]

Image

Just noticed while looking through my logs.. a particular user is logging Event 538 and 540s repeatedly throughout the day while at work, as you can see in the image. These are "Logon Type: 3".

I searched and saw its related to some type of logon and logoffs, but I dont see what would be doing this so often. Suggestions?

 

[ivwshane]

It looks normal to me.
http://eventid.net/display.asp?eventid=538&eventno=7&source=Security&phase=1
http://eventid.net/display.asp?eventid=540&eventno=9&source=Security&phase=1

 

[dawks]

Originally posted by: ivwshane
It looks normal to me.
http://eventid.net/display.asp?eventid=538&eventno=7&source=Security&phase=1
http://eventid.net/display.asp?eventid=540&eventno=9&source=Security&phase=1

This is a single user account and its happening every few seconds throughout the day, were talking thousands of occurances perday. I dont think its too normal.

Thanks!