Quantcast
Channel: Security forum
Viewing all articles
Browse latest Browse all 12072

Event 4674: "An operation was attempted on a privileged object" on Windows Server 2008 — what does it mean?

$
0
0
A while ago I enabled auditing on my WS2008 Servers and started noticing the following event repeating in the Securtiy log.

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          12/14/2008 7:10:02 PM
Event ID:      4674
Task Category: Sensitive Privilege Use
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      <Computer FQDN Here>
Description:
An operation was attempted on a privileged object.

Subject:
 Security ID:  LOCAL SERVICE
 Account Name:  LOCAL SERVICE
 Account Domain:  NT AUTHORITY
 Logon ID:  0x3e5

Object:
 Object Server: Security
 Object Type: -
 Object Name: -
 Object Handle: 0x0

Process Information:
 Process ID: 0x294
 Process Name: C:\Windows\System32\lsass.exe

Requested Operation:
 Desired Access: 16777216
 Privileges:  SeSecurityPrivilege

I found no public description of what it means and what I am supposed to do. It seemed to me that something cannot execute because 'LOCAL SERVICE' needs 'SeSecurityPrivilege' (aka 'Manage auditing and security log') right. Okay, I granted this right (double checked with RSoP and Local Policy Editor) but nothing changed. I even tried to grant this rigth to 'System' account also (by default only 'Administrators' have it). But this didn't help either.

So my question is: what should I do to get rid of these events (other then disabling auditing)? Thanks in advance.


P.S. A few links I tried but that didn't add to my understanding.


And that's all at least slightly relevant information I could find.


Viewing all articles
Browse latest Browse all 12072

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>