Understanding about Audit Logon Event

[BryanEM]

We recently have logs showing duplicate login/logout events of the user's account within seconds as well as Kerberos Ticket request. We can confirm that there is no physical user that is logging into the client machine. However, the logs are showing the logon events of the user's account. Is there any policy or services that are generating all these logs? Appreciate if someone can explain to me. Thanks.

Continue reading...