I am trying to figure out what action the user took by looking at Event Viewr as I suspect some security breeches. Event Viewer describes the category as "Privilege Use" with an Event ID = 576. Can I get any more detailed information than this?
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations SkipVought on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Event viewer question (deciphering user action)
- Thread starter zaresa
- Start date
Try this KB. Copy and paste rather than click directly on as it cuts the last section off.
soonerland
MIS
Here is some more info....
Event ID: 576
Source: Security
Type: Success Audit
Description: Special privileges assigned to new logon: User Name: Administrator Domain: CORPIIS01 Logon ID: (0x0,0x2DB2A) Assigned: SeChangeNotifyPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege
Comments: Special privileges assigned to new logon
Event ID: 576
Source: Security
Type: Success Audit
Description: Special privileges assigned to new logon: User Name: Administrator Domain: CORPIIS01 Logon ID: (0x0,0x2DB2A) Assigned: SeChangeNotifyPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege
Comments: Special privileges assigned to new logon
- Status
Similar threads
- Locked
- Question
- Locked
- Question
- Locked
- Question