Guest Colin Posted February 21, 2008 Posted February 21, 2008 Dear All Here's the background, Windows 2000 Server running AD, added a W2K server to the domain, all well, applied service packs hot fixes etc. Then made the W2K server into a domain controller (no problems with adprep), everything working perfectly except for an annoying security event being logged every so often. This only started after AD installation, it appears that the administrator account is trying to do something that requires 'act as part of the OS' priviledge. I would be most grateful if anyone could help me to troubleshoot this and correct the problem. I have attched the event below. Event Type: Failure Audit Event Source: Security Event Category: Privilege Use Event ID: 577 Date: 21/02/2008 Time: 20:16:20 User: SAUL\administrator Computer: NICOLE Description: Privileged Service Called: Server: Security Service: - Primary User Name: administrator Primary Domain: SAUL Primary Logon ID: (0x0,0x37896D4) Client User Name: - Client Domain: - Client Logon ID: - Privileges: SeTcbPrivilege For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Many thanks in advance, Colin.
Guest Carolyn Posted March 24, 2008 Posted March 24, 2008 RE: Error in Security Event log after AD install.. I am having a similar problem. I have a Windows 2003 Server, which is a domain controller, which has had 55,000 instances of Event ID 577 in just one day. Here are the details of the event: Privilege Service Called: Server: Security Service: - Primary User Name: NETWORK SERVICE Primary Domain: NT AUTHORITY Primary Logon ID: (0x0,0x3E4) Client User Name: - Client Domain: - Client Logon ID: - Privileges: SeRestorePrivilege Does anyone knows what is causing this? Thanks. -- Carolyn "Colin" wrote: > Dear All > > Here's the background, Windows 2000 Server running AD, added a W2K server to > the domain, all well, applied service packs hot fixes etc. Then made the W2K > server into a domain controller (no problems with adprep), everything > working perfectly except for an annoying security event being logged every > so often. This only started after AD installation, it appears that the > administrator account is trying to do something that requires 'act as part > of the OS' priviledge. I would be most grateful if anyone could help me to > troubleshoot this and correct the problem. I have attched the event below. > > Event Type: Failure Audit > Event Source: Security > Event Category: Privilege Use > Event ID: 577 > Date: 21/02/2008 > Time: 20:16:20 > User: SAUL\administrator > Computer: NICOLE > Description: > Privileged Service Called: > Server: Security > Service: - > Primary User Name: administrator > Primary Domain: SAUL > Primary Logon ID: (0x0,0x37896D4) > Client User Name: - > Client Domain: - > Client Logon ID: - > Privileges: SeTcbPrivilege > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. > > > > Many thanks in advance, > > Colin. > > >
Recommended Posts