Hello
The problem is following - on a DC (2008 R2) Event viewer does not display any logon / logoff information. Instead, there are thousands of following entries - "Audit Success / Source - Microsoft Windows security auditing / Event ID - 4719 / Task Category - Audit Policy Change". Under Audit Policy Change - Category - Account Logon, Changes - Success removed, Failure removed.
Group policy is set to audit logon / logoff events, auditing audit policies / policy change events is disabled, advanced audit policy configuration / system audit policies have not been set.
Generated Group Policy Results confirm the same (logon / logoff auditing enabled, Audit Policy change logging - disabled).
Thanks in advance.