Hi everyone, I'm having a bizarre issue here.When him deploying my Windows XP SP3 image my security log is filled with multiple logon/logoff event in the same second. The result is that when the computer is ready, my security log is full and I have to empty it before a user can log on.I wanted to know if it was a normal behavior or if there was something I could check on to correct that issue.The image is quite simple, OS + MS office XP (no comment on that one :) ) + software update.Thank you for your help.(Thx Torsten to remember me that it's monday morning and that I'm still asleep, posting in the wrong forum FTL)

sounds bizarre all right, could be your software updates causing multiple back and forth logins, does your SMSts.log file reveal anything related ? are you actually seeing an error message when OSD is complete or only when you try to login ?my SCCM step by step Guides > http://www.windows-noob.com/forums/index.php?showtopic=1064

There is no special error in my SMSTS.log file, the log is 216 kb so nothing really big as far as I know. I have the same behavior when installing only the OS on the computer (no update and no other software).There is no error when the deployment is finished and my updates are all installed.There is no special event logging that I know of, they are keeping the logs for 7 days.

I just deployed the same image on a computer:My security log is showing 29 500 event. Most of them (95%) are logon/logoff event done by my network access account.There is nothing related between the Advertisement Status and the start of those events.the only thing that I noticed is that the events seems to start after having applied the operating system. and that the event are showing about 10 event per second at 1st and then as much as 30 events per seconds.The audit for those events are monitored for success and failures by a GPO but it is normal to have as much as 30 000 event during a deployment?Like I said, any help would be welcome :)

Finally, the end of the story for this case was that the company was using aggressive audit of certain righst and that the account used was flooding the event viewer.