⚑ Deus Ex Machina ➽ Eventlog Lookup

Deus Ex Machina » Eventlog » Event 45058 - LsaSrv

LsaSrv - 45058


Description »
A logon cache entry for user bob.jones@NTDOMAIN.EXAMPLE.COM was the oldest entry and was removed. The timestamp of this entry was 10/10/2012 16:44:10.
Data formatted as » EventData
10/10/2012 16:44:10

Windows caches a set number of logons. This may be between 1 and 50. If there were, say, 10 cached logons, and a maximum of 10 - and then user number 11 comes to logon, the oldest of the previous 10 will be purged from the cache in order to make way for user 11, and this event will be logged to the system log.

The number of cached logons is configured in the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount registry key. It can be configured via GPO, using the Interactive logon: Number of previous logons to cache (in case domain controller is not available) policy.