SeTcbPriviledge - Event 577

Hi Folks,

I have a Dell Latitude D630 notebook and snap it into a docking station at
work. My login account has full admin priviledges. My security log fills up
in a matter of a couple of hours. The only thing that makes this somewhat
bearable is the fact that my account is "admin" and I can logon to clear it.
It would be much worse otherwise.

The problem is realized whether or not the notebook is docked. That said, I
don't think the problem is domain-related. I'm thinking it has to be
something on the local machine. -- But what? And how do I fix it?

Here is the exact error (multiply by thousands every couple of hours)

Event Type: Failure Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 577
Date: 6/19/2009
Time: 9:37:13 AM
User: DomainName\john.doe
Computer: MyComputerName
Description:
Privileged Service Called:
Server: Security
Service: -
Primary User Name: john.doe
Primary Domain: DomainName.com
Primary Logon ID: (0x0,0x3041F)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeTcbPrivilege

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Thanks!

John

I am having this same exact issue, with the same setup (Dell laptop, docking
station).

Any ideas on what is causing this?

"johncp1962" wrote:

> Hi Folks,
>
> I have a Dell Latitude D630 notebook and snap it into a docking station at
> work. My login account has full admin priviledges. My security log fills up
> in a matter of a couple of hours. The only thing that makes this somewhat
> bearable is the fact that my account is "admin" and I can logon to clear it.
> It would be much worse otherwise.
>
> The problem is realized whether or not the notebook is docked. That said, I
> don't think the problem is domain-related. I'm thinking it has to be
> something on the local machine. -- But what? And how do I fix it?
>
> Here is the exact error (multiply by thousands every couple of hours)
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Privilege Use
> Event ID: 577
> Date: 6/19/2009
> Time: 9:37:13 AM
> User: DomainName\john.doe
> Computer: MyComputerName
> Description:
> Privileged Service Called:
> Server: Security
> Service: -
> Primary User Name: john.doe
> Primary Domain: DomainName.com
> Primary Logon ID: (0x0,0x3041F)
> Client User Name: -
> Client Domain: -
> Client Logon ID: -
> Privileges: SeTcbPrivilege
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
> Thanks!
>
> John
>