The security log on the system is full. (WinXP, SP1)

**valb** · 2004-02-27 16:01

"The security log on the system is full. Only an administrator can log on to fix the problem. "

Received message upon log on to a client's PC. I could not find this in the MS knowledge base. I was able to log on as administrator, add my profile, log on successfully, then log on as client successfully? There is no limit on logons. Anyone heard of such a thing?

**Leif** · 2004-02-27 16:44

I would guess that it is referring to the Event Viewer log.

From Control Panel > Admin tools select Computer Management
Double click Event viewer
Single-click to select Security
Action > Properties
Then select a more suitable setting (such as Overwrite events as needed)

**valb** · 2004-02-27 17:04

Right on! Thanks a bunch!

**JohnGray** · 2004-02-27 21:13

Leif

Hmm - interesting! Your event log predates even the original IBM PC! And the start date/time of the DOS FAT file system also...

**Leif** · 2004-02-27 21:29

<img src=/S/laugh.gif border=0 alt=laugh width=15 height=15> - I guess that's what happens when you simply upgrade your Sinclair Spectrum rather than doing a clean install.....

(Hmmm - I shall check that out again tomorrow at work...)

**cabinets** · 2004-03-03 23:01

Thanks. This helps me out too. But why is my security folder filling up every couple of days. I have a two computer peer to peer network, both running WinXP SP1. Linksys hardwired router. There are tons and tons of anonymous logons. 4 or 5 per minute. Only on one computer. The other computer is clear.

Ken.

***JoeP517*** · 2004-03-03 23:28

Is the Guest account enabled or disabled? If it is enabled you probably want to disable it. If you have a broadband connection it would seem like someone is getting on that PC. Could you post one or two of the entries?

Joe

**cabinets** · 2004-03-03 23:45

Guest account is disabled. I will post a few entries later this evening or early tomorrow morning. Thanks.

Ken.

**cabinets** · 2004-03-04 02:22

Here are two logs. I get two of each of them every 20-30 min..

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Date: 3/3/2004
Time: 5:48:32 PM
User: NT AUTHORITYANONYMOUS LOGON
Computer: WIN2KPRO
Description:
User Logoff:
User Name: ANONYMOUS LOGON
Domain: NT AUTHORITY
Logon ID: (0x0,0x60B410)
Logon Type: 3

Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Date: 3/3/2004
Time: 5:48:32 PM
User: NT AUTHORITYANONYMOUS LOGON
Computer: WIN2KPRO
Description:
Successful Network Logon:
User Name:
Domain:
Logon ID: (0x0,0x60B421)
Logon Type: 3
Logon Process: NtLmSsp
Authentication Package: NTLM
Workstation Name: DELL-P4-26GHZ
Logon GUID: {00000000-0000-0000-0000-000000000000}

Ken.

**StuartR** · 2004-03-04 06:48

It looks like you have somehow enabled the auditing of logon and logoff events.

Try Start > Run > Gpedit.msc
this will get you into the group policy editor lo edit the local security policy.

Browse the left hand pane for Local Computer Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
Look in the right hand pane to see what auditing is enabled.

StuartR

**cabinets** · 2004-03-04 13:36

Great. Thanks. Sounds good to me. I'll try that tonight when I get home.

K.

**cabinets** · 2004-03-05 13:31

Yup, that was it. Thanks so much.

K.

Thread: The security log on the system is full. (WinXP, SP1)

Thread Tools