Discussion Locked

event id 577 and 578

0 helpful
1 reply
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Is there a way to turn just these two events off?

EVENT ID 577 FAILURE
Catagory: Privelege Use

Privileged object operation:
Object Server: Security
Object Handle: 4294967295
Process ID: 168
Primary User Name: *USERNAME*$
Primary Domain: *DOMAIN*
Primary Logon ID: (0x0,0x3E7)
Client User Name: *USERNAME*
Client Domain: *DOMAIN*
Client Logon ID: (0x0,0x427FE10)
Privileges: SeIncreaseBasePriorityPrivilege

EVENT ID 578 FAILURE
Catagory: Privelege Use

Privileged Service Called:
Server: Security
Service: -
Primary User Name: *USERNAME*
Primary Domain: *DOMAIN*
Primary Logon ID: (0x0,0x194414)
Client User Name: - Client Domain: -
Client Logon ID: -
Privileges: SeIncreaseBasePriorityPrivilege

1 reply

by noemib

EVENT ID 577: This event record indicates that an attempt has been made to use a privilege to perform a privileged system service See http://www.microsoft.com/technet/support/ee/result.aspx?EvtSrc=Security&EvtID=577&ProdName=Windows+Operating+System&LCID=1033&ProdVer=5.0

As per Microsoft: "This problem may occur when all the following conditions are true:
1. A program that is installed on your Windows XP-based computer makes a call to the SetProcessWorkingSetSize function to release the working set.
2. Auditing of the Audit privilege use category is turned on.
3. Your user account does not have the SeIncreaseBasePriorityPrivilege user right, also known as Increase Scheduling Priority?. See Q831905 for a hotfix. This should also fix EVENT ID 578

MS article 831905 - http://support.microsoft.com/default.aspx?scid=kb;en-us;831905

This discussion is closed to new replies.