Re: Access is denied

Hi Fred,

Event ID 577 appears repeatedly in the security event log of your Windows
XP-based computer
http://support.microsoft.com/default.aspx?scid=kb;en-us;831905
http://support.microsoft.com/default.aspx?scid=kb;en-us;238185
http://support.microsoft.com/default.aspx?scid=kb;en-us;811113

More info:
http://www.eventid.net/display.asp?eventid=577&eventno=2772&source=Security&phase=1

--

All the Best,
Kelly (MS-MVP)

Troubleshooting Windows XP
http://www.kellys-korner-xp.com


"Fred Jacobowitz" <Oakleigh@xxxxxxxxxxxxx> wrote in message
news:uH1vw3aSFHA.244@xxxxxxxxxxxxxxxxxxxxxxx
>I can't figure it out. I turned on audit privlege use "Failure" and
>captured this entry in the event log.
>
> The administrator and administrators have full control of the objects in
> windows\system32.
>
> Curious though - under c:\documents and settings i have the following
> folders
> Administrator
> Administrator.MICRON
> ADMINI~1~MIC
> Fred
> Mara
> Leah.MICRON
>
> and the 'active' directory when i log as administrator is
> Administrator.MICRON (based on date modified)
> By the way, MICRON is the Computer Name.
>
> Perhaps this is causing my problems?
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Privilege Use
> Event ID: 577
> Date: 4/25/2005
> Time: 11:26:48 AM
> User: MICRON\Administrator
> Computer: MICRON
> Description:
> Privileged Service Called:
> Server: Security
> Service: -
> Primary User Name: Administrator
> Primary Domain: MICRON
> Primary Logon ID: (0x0,0x13FF10)
> Client User Name: -
> Client Domain: -
> Client Logon ID: -
> Privileges: SeTcbPrivilege
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>


.

Relevant Pages

  • [NT] A Full Event Log Does Not Send Administrative Alerts
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... A security vulnerability in Microsoft's Windows operating system causes it ... to not inform the administrator whenever the Event Log has been filled ... hide his tracks by filling up the Event Log prior to attacking the system. ...
    (Securiteam)
  • Re: event logs
    ... The whole idea is to prevent a non-administrator from ... give someone administrator access he/she can login. ... However, when a standard user tries to> log onto the computer and the event log is full, i> receive the error "the security event log is full. ...
    (microsoft.public.windowsxp.security_admin)
  • Security Event Log
    ... I am tring to subscribe to the "Security" event log but I get access denied ... When I run my code as administrator it works fine but when I impersonate ... What I am trying to accomplish is to get logon, logoff, logon failure ...
    (microsoft.public.platformsdk.security)
  • [NT] User Downgraded from Administrator to User Retains the Ability to List Other Users Running Task
    ... Beyond Security would like to welcome Tiscali World Online ... Windows XP presents a new option called "Fast User Switching" (FUS). ... Eitan has found that if a user is downgraded from an administrator role to ... as shown in task manager)) via tempting the local ...
    (Securiteam)
  • Re: Is complete home security possible?
    ... > If you are a gamer, some computer games will only run in administrator ... I have a clean disk image made from Norton Ghost, ... security issues to deal with to do it monthly, ... I have been using computers since 76, never had a virus on any of my ...
    (comp.security.firewalls)