Active Administrator Foundation Service generates thousands of logon events (147088)

Return

Feedback submitted.

Was this article helpful?

[Select Rating]

Title

Active Administrator Foundation Service generates thousands of logon events
Description

Active Administrator auditing shows that the Active Administrator Foundation service generates excessive login authentication events in Active Directory.
Event ID 4672 and ID 4624 can be logged thousands of times per minute.
Cause

The Active Administrator Foundation service is being scanned by anti-virus software.
Resolution

Implement Suggested Anti-Virus Exclusions for the Active Administrator services.