Security

Ask something
Discussion Locked

Security Log Failure Audits

0 helpful
1 reply

by able-admin 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Security Log Failure Audits
Recieving multiple instances per day of these failure audits in the security logs on every computer on my domain.

EVENT ID 577 FAILURE
Catagory: Privelege Use

Privileged object operation:
Object Server: Security
Object Handle: 4294967295
Process ID: 168
Primary User Name: *USERNAME*$
Primary Domain: *DOMAIN*
Primary Logon ID: (0x0,0x3E7)
Client User Name: *USERNAME*
Client Domain: *DOMAIN*
Client Logon ID: (0x0,0x427FE10)
Privileges:SeIncreaseBasePriorityPrivilege

EVENT ID 578 FAILURE
Catagory: Privelege Use

Privileged Service Called:
Server: Security
Service: -
Primary User Name: *USERNAME*
Primary Domain: *DOMAIN*
Primary Logon ID: (0x0,0x194414)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeIncreaseBasePriorityPrivilege

are they safe to ignore or turn off failure logging?

Also getting alot of

EVENT ID 643 SUCCESS
Catagory: Account Management

Domain Policy Changed: Password Policy modified
Domain: *COMPUTERNAME*
Domain ID: *COMPUTERNAME*\
Caller User Name: *COMPUTERNAME*$
Caller Domain: *DOMAIN*
Caller Logon ID: (0x0,0x3E7)
Privileges: -

Any explanations would be appreciated

1 reply

by cbr1100xx

Admin

Lets have a look, remember from what you've shown in the event logs these seem to be at a local machine level not at a domain level.

EVENT ID 643 SUCCESS

In a nutshell, the Domain Password policy was successfully changed on the domain. Remember only a Domain admin has the priviledges to do so. Easy.

EVENT ID 578 FAILURE & EVENT ID 577 FAILURE
Basically the user listed (Client User Name: *USERNAME* and/or Primary User Name: *USERNAME*) failed a resource or network share. Not really an issue, but a warning sign that users are trying to access things they should be.

Hope that helps

B.

This discussion is closed to new replies.