We have two Exchange 2003 servers, both clustered; one of the active nodes is getting lots of events 562, 592 and 593 as below. We are having performance issues on that server, and the other one, is the level of auditing could be a reason for the performance degradation? how do we reduce, or eliminate the event below?ThanksEvent Type: Success AuditEvent Source: SecurityEvent Category: Detailed Tracking Event ID: 593Date: 10/10/2009Time: 10:29:32 PMUser: REDCROSS\ClusterServiceComputer: DAT-MSX-019Description:A process has exited: Process ID: 7364 Image File Name: C:\WINDOWS\system32\cmd.exe User Name: ClusterService Domain: REDCROSS Logon ID: (0x0,0x192C7) For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Event Type: Success AuditEvent Source: SecurityEvent Category: Object Access Event ID: 562Date: 10/10/2009Time: 10:24:14 PMUser: NT AUTHORITY\SYSTEMComputer: DAT-MSX-019Description:Handle Closed: Object Server: Microsoft Exchange Handle ID: 594564560 Process ID: 3856 Image File Name: C:\Program Files\Exchsrvr\bin\store.exe For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Hi,This is not really an Exchange configuration issue, but an windows configuration.For auditing to occur you need to enable auditing in a GPO's security setting (computer or user) and you then need to enable auditing on the objects to audit (like files).This might help: http://technet.microsoft.com/en-us/library/cc976403.aspxLeif

Hi, I agree with Leif. It's a Windows event, please write the post on Windows Server forum if you have question on it. Regarding Exchange performance issue, I suggest you read the following article: Troubleshooting Microsoft Exchange Server Performance http://technet.microsoft.com/en-us/library/aa997270(EXCHG.65).aspx Thanks, Elvis