Windows 10: Is it normal for the audit success message to trigger multiple times a second in event viewer?

I was checking my logs and i noticed that audit success was triggering like 20-30 times a second and i was wondering if that is normal, below you will find 2 screen shots, some help would be nice, thanks, also the system seems to be running as normal and this has been like this for a pretty long time i believe, i was just wondering also all the proccess ids that i could find come from within windows themself so no 3rd party apps

:)

 

Disable auditing of successful events

I want to disable auditing of successful events!

This command worked (at least CMD said it did) Code:

I need to check in event log, if there are reported any longer successful events. Problem is: overall there are too many categories to check manually!!!
So i ran this command: Code:

And i got:
System audit policy
Category/Subcategory
"No auditing" for all categories!

which is strange for 2 reasons:
- i have auditing, minimally of failure events
- there should be now auditing only for successful events...
Also in local security policy program, there is under local policy/audit policy no auditing!
While in Event Viewer i have literally under: Windows logs/Security listed events with name Audit success! So auditing had to be on! And this is even stranger, in local security policy program, i have not configured under Advanaced Audiot Policy Configuration/System Audit Policies - Local Group Policy Object. Which should be same category as by that command i used in cmd. And i had there not configured before. Which doesn't exclude auditing, if it is configured elsewhere.

Difference is i have, in what should be same category, no auditing, if i use that command in CMD! But in local security policy program: i have not configured. Which contradicts itself!

Now i am confused, what is what?!

EDIT:

Even that command executed successfully. I have still audit success in Event Viewer. Windows logs/security in particular. Anyone help? How do i disable auditing of successful events for every category?

THANKS!


Solved:

After some more googling, i found, which category is related to security events. And you can't probably disable logging of only successful events for this category.

I created custom view and for any other category, there are no successful events. So command: auditpol /Set /Category:* /success:disable should be working!

 

Too Many 'Audit Success' Security-Auditing Events Happening

That's not true. Security Audit messages are enabled by default. They didn't used to be, IIRC back in the XP days, but they have since at least vista. Don't believe me? Check your own security log.

To the original posted (yikes, 2005!) this is normal. You get tons of these in the event log by default.

 

Too Many 'Audit Success' Security-Auditing Events Happening


Thanks again. The sounds not the real issue (just helped me identify what was going on) it's the fact that the machine effectively locks up for a few seconds every time it happens. I re-posted below as JPEG