General discussion

Locked

event id 577 and 578

By norm.obrien ·
Is there a way to turn just these two events off?

EVENT ID 577 FAILURE
Catagory: Privelege Use

Privileged object operation:
Object Server: Security
Object Handle: 4294967295
Process I 168
Primary User Name: *USERNAME*$
Primary Domain: *DOMAIN*
Primary Logon I (0x0,0x3E7)
Client User Name: *USERNAME*
Client Domain: *DOMAIN*
Client Logon I (0x0,0x427FE10)
Privileges: SeIncreaseBasePriorityPrivilege


EVENT ID 578 FAILURE
Catagory: Privelege Use

Privileged Service Called:
Server: Security
Service: -
Primary User Name: *USERNAME*
Primary Domain: *DOMAIN*
Primary Logon I (0x0,0x194414)
Client User Name: - Client Domain: -
Client Logon I -
Privileges: SeIncreaseBasePriorityPrivilege

This conversation is currently closed to new comments.

1 total post (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

by noemib In reply to event id 577 and 578

EVENT ID 577: This event record indicates that an attempt has been made to use a privilege to perform a privileged system service See http://www.microsoft.com/technet/support/ee/result.aspx?EvtSrc=Security&EvtID=577&ProdName=Windows+Operating+System&LCID=1033&ProdVer=5.0

As per Microsoft: "This problem may occur when all the following conditions are true:
1. A program that is installed on your Windows XP-based computer makes a call to the SetProcessWorkingSetSize function to release the working set.
2. Auditing of the Audit privilege use category is turned on.
3. Your user account does not have the SeIncreaseBasePriorityPrivilege user right, also known as Increase Scheduling Priority?. See Q831905 for a hotfix. This should also fix EVENT ID 578

MS article 831905 - http://support.microsoft.com/default.aspx?scid=kb;en-us;831905

Back to Windows Forum
1 total post (Page 1 of 1)  

Related Discussions

Related Forums