How 2 Suppress Security Events from SYSTEM user?

How 2 Suppress Security Events from SYSTEM user?

Post by John » Thu, 20 Jul 2006 00:16:24



Past wknd fresh install of SBS2003 on a new server.  All is well.  Couple of
minor issues, and this one:

Every few seconds 2 or 3 events are logged into the Security Event Log.
They are the 538, 540, and 576 recording successful logon/logoff of the
SYSTEM user.  I like those events for my users or other services, but
thousands of unnecessary events make the log unusable (and wasteful).

Is there a method to suppress the 538,540,576's for the SYSTEM user?  I
tried several security policy changes (to log only failure events) in a
couple of places, but that doesn't seem to have worked.

As an aside, why does SYSTEM logon/logoff so frequently?

Thanks,
John B