Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Audit Failure Event ID 4674

Posted on 2012-12-28
4
Medium Priority
?
5,825 Views
Last Modified: 2013-01-08
I'm looking for the cause of this error in my Security Event Log. The server is Windows 2008 R2 Standard running Microsoft Lync 2010 with the integrated SQL (formally known as MSDE, I don't recall what they call it today). This error seems to occur about every 20 minutes or when manually running GPUPDATE. When it occurs I always get 3 in a row (never any more or less).

Log: Security
Task Category: Sensitive Privilege Use
Keywords: Audit Failure
Event ID: 4674


An operation was attempted on a privileged object.

Subject:
	Security ID:		LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3e5

Object:
	Object Server:	LSA
	Object Type:	-
	Object Name:	-
	Object Handle:	0x0

Process Information:
	Process ID:	0x1e8
	Process Name:	C:\Windows\System32\lsass.exe

Requested Operation:
	Desired Access:	16777216
	Privileges:		SeSecurityPrivilege

Open in new window

0
Comment
Question by:tpitch-ssemc
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 12

Expert Comment

by:Jeff_Schertz
ID: 38727279
That is a pretty generic log entry, but may be triggered by a elevated-permissions account accessing some object.

Take a look at this thread in TechNet for a related discussion which may point you in the right direction.  

BTW "SQL Express" is the name you are looking for.
0
 
LVL 4

Author Comment

by:tpitch-ssemc
ID: 38727918
You didn't leave teh TechNet article.

Thank you!
0
 
LVL 12

Accepted Solution

by:
Jeff_Schertz earned 2000 total points
ID: 38727952
0
 
LVL 4

Author Comment

by:tpitch-ssemc
ID: 38727957
Hey it happens to all of us.

I've seen that article. We've just filtered those alerts out until we can find the cause (meaning we'll forget about it).

Thank you!
0

Featured Post

Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
Active Directory can easily get cluttered with unused service, user and computer accounts. In this article, I will show you the way I like to implement ADCleanup..
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
Suggested Courses

660 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question