After installing Service Pack 1 or Service Pack 2 on Windows Server 2003, you may notice logon events are being logged for a user in the Security log, although the user was not active on the computer at that time. For example:
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 552
User: NT AUTHORITY\SYSTEM
Computer: <Computer>
Description:
Logon attempt using explicit credentials:
Logged on user:
User Name: <Computer$>
Domain: <Domain>
Logon ID: (0x0,0x3E7)
Logon GUID: -
User whose credentials were used:
Target User Name: <User>
Target Domain: <Domain>
Target Logon GUID: -
Target Server Name: localhost
Target Server Info: localhost
Caller Process ID: <PID>
Source Network Address: -
Source Port: -
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 540
Computer: <computer>
Successful Network Logon:
User Name: <User>
Domain: <Domain>
Logon ID: (ID)
Logon Type: 3
Logon Process: Authz
Authentication Package: Kerberos
Workstation Name: <Computer>
Logon GUID: -
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 576
Computer: <computer>
Special privileges assigned to new logon:
User Name: <User>
Domain: <Domain>
Logon ID: (ID)
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
Event Type: Success Audit
Event Source: Security
Event Category: Logon/Logoff
Event ID: 538
Computer: <computer>
User Logoff:
User Name: <User>
Domain: <Domain>
Logon ID: (ID)
Logon Type: 3
The "Logon Process" of "AuthZ" in Event ID 540 indicates this is not an actual user logon, but an authorization check that is based on the user's Active Directory security group memberships.
When inspecting the Caller Process ID (PID) in Event ID 552, you see it is the SVCHOST process that is hosting the WMI service as well as other services.
To verify that WMI is causing the events to be logged, you can move the WMI service to a separate process using the following case-sensitive command:
rundll32 %WINDIR%\system32\wbem\WMISvc.dll, MoveToAlone 4
After restarting the WinMgmt service, the Caller Process ID in Event ID 552 should now specify the process ID of the separated service process.
Note: After the problem is resolved, please follow the steps in the More Information section to move back the WMI service into a shared service executable.