Why is Event ID 4624 with LogonType=8 Logged by lsass.exe on My SQL Server?

Question

Hi,

I am observing Event ID 4624 with LogonType=8 being logged on my SQL Server, and it appears that the lsass.exe process is responsible for this logon. This occurrence is triggering a rule in our Splunk tool, causing some issues.

1. Why is the lsass.exe process generating Event ID 4624 with LogonType=8 on my SQL Server?
2. How can I resolve or prevent this from happening?

Any insights or recommendations on how to fix this issue would be greatly appreciated.

This log is related to this service:

LogName=Security

EventCode=4624

EventType=0

ComputerName=******

SourceName=Microsoft Windows security auditing.

Type=Information

Keywords=Audit Success

TaskCategory=Logon

OpCode=Info

Message=An account was successfully logged on.

 

Subject:

Security ID: NT AUTHORITY\SYSTEM

Account Name: ***

Account Domain: ****

Logon ID: 0x3E7

 

Logon Information:

Logon Type: 8

Restricted Admin Mode: -

Virtual Account: No

Elevated Token: No

 

Impersonation Level: Impersonation

 

New Logon:

Security ID: ****

Account Name: ****

Account Domain: *****

Logon ID: 0x98178

Linked Logon ID: 0x0

Network Account Name: -

Network Account Domain: -

Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:

Process ID: 0x3e8

Process Name: C:\Windows\System32\lsass.exe

 

Network Information:

Workstation Name: *****

Source Network Address: -

Source Port: -

Detailed Authentication Information:

Logon Process: ClusAuth

Authentication Package: Negotiate

Transited Services: -

Package Name (NTLM only): -

Key Length: 0

Thank you!