Event viewer - Security - Success Audit - Privilege Use

[Rob]

Hi All,

I used to be able to use the Event Viewer to monitor
security events, but now it keeps filling up with Success
Audits from Event 577, regarding Privilege Use. It
happens every 2 seconds and thus fills up the log in no
time. My concern is that someone has changed settings to
mask their activity on my machine. Any thoughts? How
can I change this to turn off the logging of these events?

 

[IBTerry [MSFT]]

Generally privilage use audit messages are not very useful. They have a
tendancy to fill your event log and usually there is not enough info to see
exactly what is going on.

You can disable auditing for this by using GPEDIT.MSC.
Navigate to computer configuration -> Windows Settings -> Security Settings
-> Local Policies -> Audit Policies.
This can also be done at the domain level.

IBTerry [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Guest]

-----Original Message-----
Generally privilage use audit messages are not very useful. They have a
tendancy to fill your event log and usually there is not enough info to see
exactly what is going on.

You can disable auditing for this by using GPEDIT.MSC.
Navigate to computer configuration -> Windows Settings -
Security Settings
-> Local Policies -> Audit Policies.
This can also be done at the domain level.

IBTerry [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.


.