On any Windows server I've worked on over the years, the security log has always been chock full of 'success audit' entries, and I've then had to filter down and remove the successes. I think only ...