This week we suddenly had problems with security logs filling up. While looking into the issue we noticed that the backup exec domain account seems to connect to every computer in the company at least once daily, sometimes two or three times daily. The event IDs are 538/540/576 which match logon/logoff and privilege use. When they show up they'll be in big batches, somewhere between 10 to 50 entries together, displaying repeated logon/logoff over the course of, say 5-10 minutes.
We're not just talking servers here, but desktops, laptops, everything we've got. We only actually use BKexec on servers, and then only on some of them. It isn't used on desktops or laptops at all.
Is this kind of behavior normal? I know there's some network discovery capability built in to the application, but to talk to every computer every day, and to have what appears to be 10 to 50 connections over the course of several minutes doesn't seem right. Could we have something misconfigured?
