Failure: Audit Privileges: SeIncreaseBasePriorityPrivilege

[Bob Ferguson]

There is a problem showing up on each Windows XP computer
that has been deploy in the Event Viewer Security section.

Type: Failure Audit Source: Security Category: Privilege
use Event: 577 User: Current log on user.
Privileged Service Called:
Server: Security
Service: -
Primary User Name: jjolson
Primary Domain: RBAKL
Primary Logon ID0x0,0x176B5)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeIncreaseBasePriorityPrivilege

The error message seems to be generating every 30 seconds.
I checked Microsoft's TechNet and I have found only
limited information about the problem.
Anyone seem this?

 

[Shain Wray]

Hello Bob,

This event is likely occuring because you have an application that is
trying to elevate the priority of its own processes or some other process.
Only admins can elevate priorty for processes, so these domain users would
get a failure. I have seen this with Office, but you should be able to
narrow it down through some testing that will clean boot your system.

1. On one of the problem systems, go to Start/Run and type MSCONFIG
2. On the General tab choose the Selective Startup option and then remove
the check next to Startup Items.
3. Click okay and reboot when asked.
4. Check to see if the Failure Audit is occuring. If so, then it is
likely a Service that is causing the problem and not something launched via
the startup items.
5. If it is a Services, you can use MSCONFIG to disable specific Services
by clicking on the Services tab.
6. First, check the box for Hide All Microsoft Services at the bottom of
the page.
7. Now, uncheck all of the Services that are left over.
8. Reboot the system and see if the problem occurs. If it does not, then
narrow down which Service it is through process of elimination.

Thanks and let me know what you find.

Best regards,
--
Shain Wray
Microsoft PSS Security Team

This posting is provided "AS IS" with no warranties and confers no rights.
Please reply to the newsgroup so that others may benefit. Thanks!