weird events, again

  • Thread starter Thread starter me
  • Start date Start date
M

me

ok ill post this again. I keep seeing in my security lg event viewer many
failed audits for something called SeTcbPrivilage. Anyone know why this is
happening?
 
Event ID & the Event Source are very important.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Event Viewer overview
http://www.microsoft.com/resources/.../xp/all/proddocs/en-us/event_overview_01.mspx

This can also be very useful.
You need to have the Event ID & the Event Source.

To view Windows XP Events and Errors, type the Source (for example, Print)
and/or the Event code (for example, 20) into the ID field, then click the Go
button. Source and Event codes may be found in the Event Viewer logs.

Windows XP Home/Professional Events and Errors
http://www.microsoft.com/technet/su...ows Operating System&MajorMinor=5.1&LCID=1033

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
 
that was no help. The link that it gave to mircosofts web site was for a
different privilage. Why is this happening
Wesley Vogel said:
Event ID & the Event Source are very important.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the
second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related
Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Event Viewer overview
http://www.microsoft.com/resources/.../xp/all/proddocs/en-us/event_overview_01.mspx

This can also be very useful.
You need to have the Event ID & the Event Source.

To view Windows XP Events and Errors, type the Source (for example, Print)
and/or the Event code (for example, 20) into the ID field, then click the
Go
button. Source and Event codes may be found in the Event Viewer logs.

Windows XP Home/Professional Events and Errors
http://www.microsoft.com/technet/su...ows Operating System&MajorMinor=5.1&LCID=1033

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
me said:
ok ill post this again. I keep seeing in my security lg event viewer
many
failed audits for something called SeTcbPrivilage. Anyone know why this
is happening?
Click to expand...
Click to expand...
 
(SeTcbPrivilege)
Act as part of the operating system

Description
Allows a process to assume the identity of any user and thus gain access to
the resources that the user is authorized to access. Typically, only
low-level authentication services require this privilege.

Default setting: Not assigned.

Note that potential access is not limited to what is associated with the
user by default; the calling process might request that arbitrary additional
privileges be added to the access token. The calling process might also
build an access token that does not provide a primary identity for tracking
events in the audit log.

When a service requires this privilege, configure the service to log on
using the Local System account, which has the privilege inherently. Do not
create a separate account and assign the privilege to it.
-----

Privilege Use Events
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prnf_msg_wjlu.asp

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
me said:
that was no help. The link that it gave to mircosofts web site was for a
different privilage. Why is this happening
Wesley Vogel said:
Event ID & the Event Source are very important.

To open the Event Viewer...
Start | Run | Type: eventvwr | OK

For any Events that seem related to the problem...

Double click the event in Event Viewer | Click: the button below the
second
arrow (looks like two pages) [[Copies the details of the event to the
Clipboard.]] | Paste into Notepad | Click:
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Read all info | Copy and paste to Notepad | Click the [+] Related
Knowledge
Base articles | Follow any links that might be useful

HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

Event Viewer overview
http://www.microsoft.com/resources/.../xp/all/proddocs/en-us/event_overview_01.mspx

This can also be very useful.
You need to have the Event ID & the Event Source.

To view Windows XP Events and Errors, type the Source (for example,
Print) and/or the Event code (for example, 20) into the ID field, then
click the Go
button. Source and Event codes may be found in the Event Viewer logs.

Windows XP Home/Professional Events and Errors
http://www.microsoft.com/technet/su...ows Operating System&MajorMinor=5.1&LCID=1033

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In
me said:
ok ill post this again. I keep seeing in my security lg event viewer
many
failed audits for something called SeTcbPrivilage. Anyone know why this
is happening?
Click to expand...
Click to expand...
Click to expand...
 
Back
Top