Re: Event ID 577 Every few seconds

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 11/29/03 

Date: Sat, 29 Nov 2003 15:18:35 -0700

Sorry the confusion on my part, it to 568 as the event id
instead of 577 from the subject.
So, skip the info about making a hard-link.
577 is less specific, only indicating use of the
system service for privileged operation. 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Dean McCreary" <dean@themccrearys.com> wrote in message
news:eSgmeBrtDHA.1196@TK2MSFTNGP12.phx.gbl...
> Thanks for the response.  The username is mine.  I have admin access.
>
> Dean
>
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:%23rR5NYotDHA.556@TK2MSFTNGP11.phx.gbl...
> > The importance of this all depends on what you
> > can tell us of the account "username"
> >
> > -- 
> > Roger Abell
> > Microsoft MVP (Windows Server System: Security)
> > MCSE (W2k3,W2k,Nt4)  MCDBA
> > "dean" <anonymous@discussions.microsoft.com> wrote in message
> > news:071b01c3b66d$0f0f3050$a101280a@phx.gbl...
> > > This event is getting logged every few seconds in the
> > > security log. Any ideas?  This feels like a security
> > > breech. Any help would be appreciated.
> > >
> > > Privileged object operation:
> > >   Object Server: EventLog
> > >   Object Handle: 12649776
> > >   Process ID: 568
> > >   Primary User Name: ComputerName$
> > >   Primary Domain: DOMAINNAME
> > >   Primary Logon ID: (0x0,0x3E7)
> > >   Client User Name: username
> > >   Client Domain: DOMAINNAME
> > >   Client Logon ID: (0x0,0x114A6)
> > >   Privileges: SeSecurityPrivilege
> > >
> >
> >
>
>

Relevant Pages

  • Re: NEED HELP HERE! Check XP Access Problems Below!
    ... >>Roger Abell ... >>Microsoft MVP (Windows Server System: Security) ... >>>>When attempt to create new accounts, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Runas command
    ... Roger Abell ... Microsoft MVP (Windows Server System: Security) ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Q81114 Security Update
    ... Roger Abell ... Microsoft MVP (Windows Server System: Security) ... that it needs to install the Q81114 Security Update, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: "view source" doesnt work!!
    ... Roger Abell ... Microsoft MVP (Windows Server System: Security) ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Event ID 577 Every few seconds
    ... can tell us of the account "username" ... Microsoft MVP (Windows Server System: Security) ... > Client Domain: DOMAINNAME ...
    (microsoft.public.windowsxp.security_admin)