Overload: 562/565 Security Events (Success Audit)

Hello,

we are seeing multipe 562/565 events, mostly as pairs, for a couple of
machines on our Windows 2003 domain at a rate of around 3000 per second.

Part of 562;
Handle Closed:
Object Server: Security Account Manager
Handle ID: 113019808
Process ID: 512
Image File Name: C:\WINDOWS\system32\lsass.exe

Process 512 does not show up in the list of processes viewed via Task
Manager on the workstation.

User: in both events is domain\machinename$.

How would I go about finding which Directory Service Access (565) or Object
Access (562) these refer to or troubleshooting please as this is not typical
behaviour on our network?

Regards,
--
swtmike

That should be '3000 per minute'. Per second varies with a peak of around 270.
--
swtmike


"swtmike" wrote:

> Hello,
>
> we are seeing multipe 562/565 events, mostly as pairs, for a couple of
> machines on our Windows 2003 domain at a rate of around 3000 per second.
>
> Part of 562;
> Handle Closed:
> Object Server: Security Account Manager
> Handle ID: 113019808
> Process ID: 512
> Image File Name: C:\WINDOWS\system32\lsass.exe
>
> Process 512 does not show up in the list of processes viewed via Task
> Manager on the workstation.
>
> User: in both events is domain\machinename$.
>
> How would I go about finding which Directory Service Access (565) or Object
> Access (562) these refer to or troubleshooting please as this is not typical
> behaviour on our network?
>
> Regards,
> --
> swtmike