Avatar of tpitch-ssemc
tpitch-ssemc
Flag for United States of America asked on

Audit Failure Event ID 4674

I'm looking for the cause of this error in my Security Event Log. The server is Windows 2008 R2 Standard running Microsoft Lync 2010 with the integrated SQL (formally known as MSDE, I don't recall what they call it today). This error seems to occur about every 20 minutes or when manually running GPUPDATE. When it occurs I always get 3 in a row (never any more or less).

Log: Security
Task Category: Sensitive Privilege Use
Keywords: Audit Failure
Event ID: 4674


An operation was attempted on a privileged object.

Subject:
	Security ID:		LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3e5

Object:
	Object Server:	LSA
	Object Type:	-
	Object Name:	-
	Object Handle:	0x0

Process Information:
	Process ID:	0x1e8
	Process Name:	C:\Windows\System32\lsass.exe

Requested Operation:
	Desired Access:	16777216
	Privileges:		SeSecurityPrivilege

Open in new window

Windows Server 2008Active Directory

Avatar of undefined
Last Comment
tpitch-ssemc

8/22/2022 - Mon
Jeff_Schertz

That is a pretty generic log entry, but may be triggered by a elevated-permissions account accessing some object.

Take a look at this thread in TechNet for a related discussion which may point you in the right direction.  

BTW "SQL Express" is the name you are looking for.
tpitch-ssemc

ASKER
You didn't leave teh TechNet article.

Thank you!
ASKER CERTIFIED SOLUTION
Jeff_Schertz

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
tpitch-ssemc

ASKER
Hey it happens to all of us.

I've seen that article. We've just filtered those alerts out until we can find the cause (meaning we'll forget about it).

Thank you!
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes