返回
-
标题
Large number of 4776 Security Events logged on the DCs -
说明
The Security Event log of some (or all) DCs has Event ID 4776 logged about every minute, referencing the Active Administrator Foundation Service account as the logon account and the AA server as the source workstation. -
原因
Active Directory Health Agents. -
解决办法
When the Active Directory Health Agent is installed on a DC, AA queries the agent every 60 seconds to obtain fresh information for most of the Data Collectors that the AD Health module reports on. This is by design to ensure the data is up to date and that the alerts can be generated shortly after an issue occurs. The query require an authentication to occur.
To reduce the number of DCs that the authentications occur on, use the Agent Pool option to install agents on as few DCs as possible.