Discussion:
Event ID 577 messsages filling up security log
(too old to reply)
Morten Holst
2005-05-18 20:23:07 UTC
Permalink
Hello


The security logs on all out domain controllers are filling up with Event ID
577 messages.
Momaction account is member of the domain admins groups.
Anyone have a clue how to get rid of this.

Event Type: Failure Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 577
Date: 18.05.2005
Time: 21:41:30
User: domain name\momaction
Computer: test
Description:
Privileged Service Called:
Server: Security
Service: -
Primary User Name: momaction
Primary Domain: domain name
Primary Logon ID: (0x0,0x1331C)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeIncreaseBasePriorityPrivilege

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
--
Morten Holst
Christopher Coy (MSFT)
2005-06-01 19:54:06 UTC
Permalink
If this is a Windows 2000 machine, you have two options:

1 - Disable the failure audit on the 'Audit privilege use' policy.

2 - Ignore the event.

There is not fix for this on Windows 2000.
--
Christopher Coy

You may log a bug or Feature Request directly to the MOM Product Team by
going to http://www.microsoft.com/mom/feedback. This posting is provided "AS
IS" with no warranties, and confers no rights. Use of any included script
samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
Post by Morten Holst
Hello
The security logs on all out domain controllers are filling up with Event ID
577 messages.
Momaction account is member of the domain admins groups.
Anyone have a clue how to get rid of this.
Event Type: Failure Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 577
Date: 18.05.2005
Time: 21:41:30
User: domain name\momaction
Computer: test
Server: Security
Service: -
Primary User Name: momaction
Primary Domain: domain name
Primary Logon ID: (0x0,0x1331C)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeIncreaseBasePriorityPrivilege
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
--
Morten Holst
Loading...