Several Logons on a DC where the account is the Active Administrator Foundation service run as account.
说明
Several interactive logons on a (DC) Domain Controllers where the account is the Active Administrator Foundation service "run as" account.
解决办法
The (AFS) Active Administrator Foundation service impersonation account logs on to its authenticating DC when it performs certain operations:
Query from the (AA Reports) database
Polling DCs service control manager to obtain status of the AA Agents
Scheduled events such as replication monitoring (by default ran every 30 minutes)
AD query from several Active Administrator modules and then the account is logged off when operation completes. Logons include Kerberos authentication (event IDs 4768, 4769, 4624)