Troubleshooting Security events in Server 2012

Question

I am seeing alot of activity in the events log associated with the MSOL_xxxxx account especially off hours. Is this normal or should I be looking for a cause? The event logs samples are below.

Security: A Kerberos authentication ticket (TGT) was requested.
Security: A Kerberos service ticket was requested.
Security: A logon was attempted using explicit credentials.
Security: An account was successfully logged on.
Security: An account was logged off.
Security: A Kerberos authentication ticket (TGT) was requested.
Security: A Kerberos service ticket was requested.
Security: A logon was attempted using explicit credentials.
Security: An account was successfully logged on.
Security: An account was logged off.

Security: An account was successfully logged on.
Security: An operation was performed on an object.
Security: An operation was performed on an object.
Security: An operation was performed on an object.
Security: A Kerberos service ticket was requested.
Security: A logon was attempted using explicit credentials.
Security: An account was successfully logged on.
Security: An account was logged off.
Security: Special privileges assigned to new logon.
Security: An account was successfully logged on.
Security: An account was logged off.
Security: Special privileges assigned to new logon.
Security: An account was successfully logged on.

Answer 1

Hello,

Thank you so much for posting here.

Once we configured these audit policies, there will be event logs recorded such as:

Security: A Kerberos authentication ticket (TGT) was requested.
Security: A logon was attempted using explicit credentials.
Security: An account was successfully logged on.
Security: An account was logged off.

If lots of accounts log on, there will be lots of activities in the event logs. According to our description, all the event logs are associated with certain account. If we have any doubt, we could verity whether this account is real and existed and then contact the account MSOL_xxxxx account to verify whether this account has preformed the actions.

For any question, please feel free to contact us.

Best regards,
Hannah Xiong