Audit Failure Event ID 4674

tpitch-ssemc
tpitch-ssemc used Ask the Experts™
on
I'm looking for the cause of this error in my Security Event Log. The server is Windows 2008 R2 Standard running Microsoft Lync 2010 with the integrated SQL (formally known as MSDE, I don't recall what they call it today). This error seems to occur about every 20 minutes or when manually running GPUPDATE. When it occurs I always get 3 in a row (never any more or less).

Log: Security
Task Category: Sensitive Privilege Use
Keywords: Audit Failure
Event ID: 4674


An operation was attempted on a privileged object.

Subject:
	Security ID:		LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3e5

Object:
	Object Server:	LSA
	Object Type:	-
	Object Name:	-
	Object Handle:	0x0

Process Information:
	Process ID:	0x1e8
	Process Name:	C:\Windows\System32\lsass.exe

Requested Operation:
	Desired Access:	16777216
	Privileges:		SeSecurityPrivilege

Open in new window

Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
View Solution Only
Jeff_Schertz

Commented:
That is a pretty generic log entry, but may be triggered by a elevated-permissions account accessing some object.

Take a look at this thread in TechNet for a related discussion which may point you in the right direction.  

BTW "SQL Express" is the name you are looking for.
tpitch-ssemc

Author

Commented:
You didn't leave teh TechNet article.

Thank you!
tpitch-ssemc

Author

Commented:
Hey it happens to all of us.

I've seen that article. We've just filtered those alerts out until we can find the cause (meaning we'll forget about it).

Thank you!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial