Return
-
Title
Several Logons on a DC where the account is the Active Administrator Foundation service run as account. -
Description
Several interactive logons on a (DC) Domain Controllers where the account is the Active Administrator Foundation service "run as" account. -
Resolution
The (AFS) Active Administrator Foundation service impersonation account logs on to its authenticating DC when it performs certain operations:
- Query from the (AA Reports) database
- Polling DCs service control manager to obtain status of the AA Agents
- Scheduled events such as replication monitoring (by default ran every 30 minutes)
- AD query from several Active Administrator modules and then the account is logged off when operation completes. Logons include Kerberos authentication (event IDs 4768, 4769, 4624)