weird events, again

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

ok ill post this again. I keep seeing in my security lg event viewer many
failed audits for something called SeTcbPrivilage. Anyone know why this is
happening?
3 answers Last reply
More about weird events again
  1. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    Event ID & the Event Source are very important.

    To open the Event Viewer...
    Start | Run | Type: eventvwr | OK

    For any Events that seem related to the problem...

    Double click the event in Event Viewer | Click: the button below the second
    arrow (looks like two pages) [[Copies the details of the event to the
    Clipboard.]] | Paste into Notepad | Click:
    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    Read all info | Copy and paste to Notepad | Click the [+] Related Knowledge
    Base articles | Follow any links that might be useful

    HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
    http://support.microsoft.com/default.aspx?scid=kb;en-us;308427

    Event Viewer overview
    http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/event_overview_01.mspx

    This can also be very useful.
    You need to have the Event ID & the Event Source.

    To view Windows XP Events and Errors, type the Source (for example, Print)
    and/or the Event code (for example, 20) into the ID field, then click the Go
    button. Source and Event codes may be found in the Event Viewer logs.

    Windows XP Home/Professional Events and Errors
    http://www.microsoft.com/technet/support/ee/search.aspx?DisplayName=Windows%20XP%20Professional&ProdName=Windows%20Operating%20System&MajorMinor=5.1&LCID=1033

    --
    Hope this helps. Let us know.

    Wes
    MS-MVP Windows Shell/User

    In news:uVFFCSmfFHA.1444@TK2MSFTNGP10.phx.gbl,
    me <jmforbk@earthlink.net> hunted and pecked:
    > ok ill post this again. I keep seeing in my security lg event viewer many
    > failed audits for something called SeTcbPrivilage. Anyone know why this
    > is happening?
  2. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    that was no help. The link that it gave to mircosofts web site was for a
    different privilage. Why is this happening
    "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
    news:eZkKWjnfFHA.3936@TK2MSFTNGP14.phx.gbl...
    > Event ID & the Event Source are very important.
    >
    > To open the Event Viewer...
    > Start | Run | Type: eventvwr | OK
    >
    > For any Events that seem related to the problem...
    >
    > Double click the event in Event Viewer | Click: the button below the
    > second
    > arrow (looks like two pages) [[Copies the details of the event to the
    > Clipboard.]] | Paste into Notepad | Click:
    > For more information, see Help and Support Center at
    > http://go.microsoft.com/fwlink/events.asp.
    >
    > Read all info | Copy and paste to Notepad | Click the [+] Related
    > Knowledge
    > Base articles | Follow any links that might be useful
    >
    > HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
    > http://support.microsoft.com/default.aspx?scid=kb;en-us;308427
    >
    > Event Viewer overview
    > http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/event_overview_01.mspx
    >
    > This can also be very useful.
    > You need to have the Event ID & the Event Source.
    >
    > To view Windows XP Events and Errors, type the Source (for example, Print)
    > and/or the Event code (for example, 20) into the ID field, then click the
    > Go
    > button. Source and Event codes may be found in the Event Viewer logs.
    >
    > Windows XP Home/Professional Events and Errors
    > http://www.microsoft.com/technet/support/ee/search.aspx?DisplayName=Windows%20XP%20Professional&ProdName=Windows%20Operating%20System&MajorMinor=5.1&LCID=1033
    >
    > --
    > Hope this helps. Let us know.
    >
    > Wes
    > MS-MVP Windows Shell/User
    >
    > In news:uVFFCSmfFHA.1444@TK2MSFTNGP10.phx.gbl,
    > me <jmforbk@earthlink.net> hunted and pecked:
    >> ok ill post this again. I keep seeing in my security lg event viewer
    >> many
    >> failed audits for something called SeTcbPrivilage. Anyone know why this
    >> is happening?
    >
  3. Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

    (SeTcbPrivilege)
    Act as part of the operating system

    Description
    Allows a process to assume the identity of any user and thus gain access to
    the resources that the user is authorized to access. Typically, only
    low-level authentication services require this privilege.

    Default setting: Not assigned.

    Note that potential access is not limited to what is associated with the
    user by default; the calling process might request that arbitrary additional
    privileges be added to the access token. The calling process might also
    build an access token that does not provide a primary identity for tracking
    events in the audit log.

    When a service requires this privilege, configure the service to log on
    using the Local System account, which has the privilege inherently. Do not
    create a separate account and assign the privilege to it.
    -----

    Privilege Use Events
    http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prnf_msg_wjlu.asp

    --
    Hope this helps. Let us know.

    Wes
    MS-MVP Windows Shell/User

    In news:%23mXGxocgFHA.1468@TK2MSFTNGP14.phx.gbl,
    me <jmforbk@earthlink.net> hunted and pecked:
    > that was no help. The link that it gave to mircosofts web site was for a
    > different privilage. Why is this happening
    > "Wesley Vogel" <123WVogel955@comcast.net> wrote in message
    > news:eZkKWjnfFHA.3936@TK2MSFTNGP14.phx.gbl...
    >> Event ID & the Event Source are very important.
    >>
    >> To open the Event Viewer...
    >> Start | Run | Type: eventvwr | OK
    >>
    >> For any Events that seem related to the problem...
    >>
    >> Double click the event in Event Viewer | Click: the button below the
    >> second
    >> arrow (looks like two pages) [[Copies the details of the event to the
    >> Clipboard.]] | Paste into Notepad | Click:
    >> For more information, see Help and Support Center at
    >> http://go.microsoft.com/fwlink/events.asp.
    >>
    >> Read all info | Copy and paste to Notepad | Click the [+] Related
    >> Knowledge
    >> Base articles | Follow any links that might be useful
    >>
    >> HOW TO: View and Manage Event Logs in Event Viewer in Windows XP
    >> http://support.microsoft.com/default.aspx?scid=kb;en-us;308427
    >>
    >> Event Viewer overview
    >>
    http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/event_overview_01.mspx
    >>
    >> This can also be very useful.
    >> You need to have the Event ID & the Event Source.
    >>
    >> To view Windows XP Events and Errors, type the Source (for example,
    >> Print) and/or the Event code (for example, 20) into the ID field, then
    >> click the Go
    >> button. Source and Event codes may be found in the Event Viewer logs.
    >>
    >> Windows XP Home/Professional Events and Errors
    >>
    http://www.microsoft.com/technet/support/ee/search.aspx?DisplayName=Windows%20XP%20Professional&ProdName=Windows%20Operating%20System&MajorMinor=5.1&LCID=1033
    >>
    >> --
    >> Hope this helps. Let us know.
    >>
    >> Wes
    >> MS-MVP Windows Shell/User
    >>
    >> In news:uVFFCSmfFHA.1444@TK2MSFTNGP10.phx.gbl,
    >> me <jmforbk@earthlink.net> hunted and pecked:
    >>> ok ill post this again. I keep seeing in my security lg event viewer
    >>> many
    >>> failed audits for something called SeTcbPrivilage. Anyone know why this
    >>> is happening?
Ask a new question

Read More

Microsoft Security Event Viewer Events Windows XP