Hi,
It's my first thread here and I hope to get some suggestions on my problem as I've been trying to search for similar problems on net but to no avail.
I'm troubleshooting a Windows Server 2003 machine, it has a lot of multiple event id 538 from an admin account that is not used by anybody at all. It's logon type 3. Strangely, there is only event 538 but no 528.
I've searched all over the net and found out that there is a "token leak" issue with similiar symptoms for Win2k machine, which can be solved partially by installing a SP4. However, I couldnt find any issue or resolution of this for Windows Server 2003, so I'm also not sure whether it's the same cause. Any kind souls can advice me?
|