Strange behaviour with use right SeMachineAccountPrivilege

I am monitoring the event logs on computer A that has supposely is locked down which is only accessible by user A. In the event log I noticed
eventid: 608 Type:Success A User: NT AUTHORITY\SYSTEM Computer A
Description: User right Assigned:
User Right: SeMachineAccountPrivilege
Assigned To: xxx\USER B
Username: COMPUTER_A$
DOMAIN: xxx
Logon ID: (#x#, #x#A#)

Would this indicate that USER B is trying to access computer_A or is USER B creating a machine and assigning same computer name to see if user b can gain access. So esstenially what I'm asking is USER B actually breaking into computer_A.

Thanks,
LVL 2
xeyeclanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Ancient_OrangeCommented:
Hi.

If a user gets granted the SeMachineAccountPrivileg he has got the ability to add a new Computer to the Domain,
Meening he can hook every pc he wants into the Domain

The eventlog only says that USer B got that right not that he has tried to acess something or so.

but i guess if you can't remember granting this privileg you should checl whats going on there ?

are you the only admin on that maschine or do more users have acess to userA ?

best regards AO
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Ancient_OrangeCommented:
Short notice:

I'm going to bed now (i'ts about 11p.m here in austria)

possibly someone else will be able to help you in the mean time.
if not i'l be @ your service in about 12 hours again.

with best regards AO
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Security

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.