Audit Failure Event ID 4674

I'm looking for the cause of this error in my Security Event Log. The server is Windows 2008 R2 Standard running Microsoft Lync 2010 with the integrated SQL (formally known as MSDE, I don't recall what they call it today). This error seems to occur about every 20 minutes or when manually running GPUPDATE. When it occurs I always get 3 in a row (never any more or less).

Log: Security
Task Category: Sensitive Privilege Use
Keywords: Audit Failure
Event ID: 4674


An operation was attempted on a privileged object.

Subject:
	Security ID:		LOCAL SERVICE
	Account Name:		LOCAL SERVICE
	Account Domain:		NT AUTHORITY
	Logon ID:		0x3e5

Object:
	Object Server:	LSA
	Object Type:	-
	Object Name:	-
	Object Handle:	0x0

Process Information:
	Process ID:	0x1e8
	Process Name:	C:\Windows\System32\lsass.exe

Requested Operation:
	Desired Access:	16777216
	Privileges:		SeSecurityPrivilege

Open in new window

LVL 4
tpitch-ssemcAsked:
Who is Participating?
Advertise Here
 
Jeff_SchertzConnect With a Mentor Commented:
0
 
Jeff_SchertzCommented:
That is a pretty generic log entry, but may be triggered by a elevated-permissions account accessing some object.

Take a look at this thread in TechNet for a related discussion which may point you in the right direction.  

BTW "SQL Express" is the name you are looking for.
0
 
tpitch-ssemcAuthor Commented:
You didn't leave teh TechNet article.

Thank you!
0
 
tpitch-ssemcAuthor Commented:
Hey it happens to all of us.

I've seen that article. We've just filtered those alerts out until we can find the cause (meaning we'll forget about it).

Thank you!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.