Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

How to stop the Security Log being flooded with Event ID 577?

Posted on 2013-12-16
3
Medium Priority
?
1,626 Views
Last Modified: 2013-12-31
I'm running Windows Server 2003 with a Cluster File Service.
The security log is being flooded with Failure Audit Event ID 577 entries.

Example:
When a user opens a folder on the network drive on this server it creates about 80 exact same log entries at once:

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Privilege Use
Event ID:      577
Date:            16.12.2013
Time:            11:30:31
User:            DOMAIN\USER
Computer:      SERVERNAME
Description:
Privileged Service Called:
       Server:            Security
       Service:            -
       Primary User Name:      SERVERNAME$
       Primary Domain:      DOMAIN
       Primary Logon ID:      LOGONID
       Client User Name:      USER
       Client Domain:      DOMAIN
       Client Logon ID:      LOGONID
       Privileges:      SeBackupPrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


The local policies are Setup as below and can't be changed as set by the Domain:
Security Option: Audit the use of Backup and Restore privilege - Enabled
Audit Policy: Audit privilege use - Success and Failure
0
Comment
Question by:da2loo
  • 2
3 Comments
 
LVL 14

Accepted Solution

by:
BlueCompute earned 1500 total points
ID: 39721865
Audit Policy: Audit privilege use - Success and Failure

SO you've turned your auditing up too high and now you can't see the wood for the trees.  It's similar to the scenario described in this old KB: http://support.microsoft.com/kb/264769

You can't delete events from the security log, and you've indicated that you are unable to remove the auditing.  Therefore you cannot prevent your log filling up with these entries.
0
 

Author Comment

by:da2loo
ID: 39722670
I understand that the Security log will always keep filling up when having the audit privilege use policy enabled, however, the amount being logged seems odd. There's not even space for an entire day of security logs in the 400 MB log file.

One user opening one folder produces 80 event log entries with the exactly same information all at once, is this normal with these policies enabled?

Any idea what could cause all normal users accessing the files/folders on the server attempting to use SeBackupPrivilege in the first place?
0
 
LVL 14

Expert Comment

by:BlueCompute
ID: 39722698
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many admins will agree: WSUS is is a nice invention but using it on the client side when updating a newly installed computer is still time consuming as you have to do several reboots and furthermore, the procedure of installing updates, rebooting an…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Suggested Courses

782 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question