Event ID: 577

SYMPTOMS
========

When you are using a Remote Procedure Call-based (RPC-based) client/server
program, the following Security Failure Audit may be logged in the Security
event log:

Event ID: 577 Source: Security Type: Failure Audit Category: Privilege Use
User: Computer:
Text:
Privileged Service Called:
Server: NT Local Security Authority / Authentication Service
Service: LsaRegisterLogonProcess()
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name:
Client Domain:
Client Logon ID: (0x0,0x1234)
Privileges: SeTcbPrivilege

CAUSE
=====

The security audit occurs while the RPC subsystem acquires the user's
credentials for authenticated RPC. There are two ways for the code to do this.
If the first method does not succeed, the second method is tried. In this case,
the first method (calling the LSA directly) does not succeed and generates an
Audit Failure entry.

RESOLUTION
==========

This audit does not indicate a security breach and can be safely ignored.

Windows NT Server or Workstation 4.0
------------------------------------

To resolve this problem, obtain the latest service pack for Windows NT 4.0 or the
individual software update. For information on obtaining the latest service
pack, please go to:

- http://www.microsoft.com/Windows/ServicePacks/

-or-

- Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack