Link to home
Start Free TrialLog in
Avatar of tpitch-ssemc
tpitch-ssemcFlag for United States of America

asked on

Audit Failure Event ID 4674

I'm looking for the cause of this error in my Security Event Log. The server is Windows 2008 R2 Standard running Microsoft Lync 2010 with the integrated SQL (formally known as MSDE, I don't recall what they call it today). This error seems to occur about every 20 minutes or when manually running GPUPDATE. When it occurs I always get 3 in a row (never any more or less).

Log: Security
Task Category: Sensitive Privilege Use
Keywords: Audit Failure
Event ID: 4674


An operation was attempted on a privileged object.

Subject:
	Security ID:		LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3e5

Object:
	Object Server:	LSA
	Object Type:	-
	Object Name:	-
	Object Handle:	0x0

Process Information:
	Process ID:	0x1e8
	Process Name:	C:\Windows\System32\lsass.exe

Requested Operation:
	Desired Access:	16777216
	Privileges:		SeSecurityPrivilege

Open in new window

Avatar of Jeff_Schertz
Jeff_Schertz
Flag of United States of America image

That is a pretty generic log entry, but may be triggered by a elevated-permissions account accessing some object.

Take a look at this thread in TechNet for a related discussion which may point you in the right direction.  

BTW "SQL Express" is the name you are looking for.
Avatar of tpitch-ssemc

ASKER

You didn't leave teh TechNet article.

Thank you!
ASKER CERTIFIED SOLUTION
Avatar of Jeff_Schertz
Jeff_Schertz
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Hey it happens to all of us.

I've seen that article. We've just filtered those alerts out until we can find the cause (meaning we'll forget about it).

Thank you!