Forum Discussion
Cole_McDonald
Professor
16 days agoWith a list of the 4625 events in the Windows security log, check the amount of time between each 4625. See if you can workout the pattern there. Then you can check any 'Sources in the Modules section that are set to collect at that specific frequency... in LM for that collector, open a debug console and do a !tlist. Check for anything that seems to be failing there. I also recall a Collector Debug/Status report in the Settings > Collectors page that had helped me ID failing modules at some point.