J
John Collins
Our Windows 2000 print server (in AD as a member server) is filling up the
security event log with #578's like below. I understand it to be a "take
ownership" privilege log entry. It's the same user's ID (my bosses actually)
and has anywhere from 24 to over 50 identical entries with the exact same
time. Each group of identical entries is separated by only seconds, say 30
or 45 seconds between groups.
The user is not logged into the server but does have four printers defined
in his printer folder on his desktop. The entries show up whether he is
printing or not. The user is a member of the local administrators group on
the server.
While troubleshooting this and looking at the Task Manger I noticed that
periodically, every minute or so, an Image Name of hpbpro.e x e shows up
(usually two or three at a time) with the User Name of this user ID and the
session number indicates the console. He is not logged into the console at
the times that this happens. These processes show up and disappear in the
blink of an eye. And are quite regular, almost coincidental with the above
messages.
Any idea?
========= Event Description Below ===============
Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 578
Date: 05-Apr-04
Time: 12:29:52
User: Domain\UserID
Computer: SERVER
Description:
Privileged object operation:
Object Server: Security
Object Handle: 496
Process ID: 3056
Primary User Name: UserID
Primary Domain: Domain
Primary Logon ID: (0x0,0x1E91EEDF)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeTakeOwnershipPrivilege
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
security event log with #578's like below. I understand it to be a "take
ownership" privilege log entry. It's the same user's ID (my bosses actually)
and has anywhere from 24 to over 50 identical entries with the exact same
time. Each group of identical entries is separated by only seconds, say 30
or 45 seconds between groups.
The user is not logged into the server but does have four printers defined
in his printer folder on his desktop. The entries show up whether he is
printing or not. The user is a member of the local administrators group on
the server.
While troubleshooting this and looking at the Task Manger I noticed that
periodically, every minute or so, an Image Name of hpbpro.e x e shows up
(usually two or three at a time) with the User Name of this user ID and the
session number indicates the console. He is not logged into the console at
the times that this happens. These processes show up and disappear in the
blink of an eye. And are quite regular, almost coincidental with the above
messages.
Any idea?
========= Event Description Below ===============
Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 578
Date: 05-Apr-04
Time: 12:29:52
User: Domain\UserID
Computer: SERVER
Description:
Privileged object operation:
Object Server: Security
Object Handle: 496
Process ID: 3056
Primary User Name: UserID
Primary Domain: Domain
Primary Logon ID: (0x0,0x1E91EEDF)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeTakeOwnershipPrivilege
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.