Re: Event Viewer/Security

ID: 576
Source: Security
http://www.microsoft.com/technet/support/ee/transform.aspx?ProdName=Windows%20Operating%20System&ProdVer=5.0&EvtID=576&EvtSrc=Security&LCID=1033

Event ID: 576
Source Security
http://www.eventid.net/display.asp?eventid=576&eventno=58&source=Security&phase=1

No need to subscribe to EventID.net....

M174074 is
Security Event Descriptions
http://support.microsoft.com/kb/174074

M264769 is
Event ID 576 Fills the Security Event Log When Auditing
http://support.microsoft.com/kb/264769

M822774 is
System Performance Decreases, and Many Event ID 576 Entries Are Logged to
the Security Event Log
http://support.microsoft.com/kb/822774

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:45e46d95$0$2938$ba620e4c@xxxxxxxxxxxxxx,
BrianF <bk266378@xxxxxxxxx> hunted and pecked:
I seem to be getting a large number of logon entries in this folder, most
successful but an occasional block of five failed entries saying an
incorrect password was attempted. This is quite worrying because I cannot
identify the origin of these attempts.
The PC has been thoroughly scanned for viruses, trojans and malware but
all come back negative - not surprising as I have a NAT router, personal
firewall, AVG, Windows Defender and PestPatrol all active.
On the other hand, I have three PCs running WindowsXP Pro and it is only
this one that has this problem.

An example of one random entry is:

Special privileges assigned to new logon:

User Name: NETWORK SERVICE

Domain: NT AUTHORITY

Logon ID: (0x0,0x3E4)

Privileges: SeAuditPrivilege

SeAssignPrimaryTokenPrivilege

SeChangeNotifyPrivilege

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


Does this suggest anything to any of the experts here?

.

Relevant Pages

  • Re: Empty Security Event Log
    ... > I have built a Windows 2000 Server and joined it to a NT ... But the Security Event ...
    (microsoft.public.security)
  • WindowsXP Computer Accounts Are Getting Reset in Windows2003 ADS
    ... Computer Accounts are getting automatically reset in Windows 2003 based ... Workstations are WindowsXP Professional.We have Primary Domain controller ... In the security event log following is the message getting logged. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Broken Event Logging
    ... Dave Patrick ....Please no email replies - reply in newsgroup. ... Microsoft MVP [Windows] ... "Leppy99" wrote: ... I got the Security Event Logworking but I can't ...
    (microsoft.public.win2000.general)
  • Re: Event Viewer/Security
    ... Event ID 576 Fills the Security Event Log When Auditing ... and Many Event ID 576 Entries Are Logged to ... MS-MVP Windows Shell/User ...
    (microsoft.public.windowsxp.security_admin)
  • Kerberose Error
    ... I have the following error in my SECURITY EVENT LOG... ... Logon Failure: ... Unknown user name or bad password ... Authentication Package: Kerberos ...
    (microsoft.public.windowsxp.security_admin)