locked
Event Viewer Security Log - Logon Process: Advapi RRS feed

  • Question

  • I'm seeing the following events every 30 seconds on an XP workstation. Any ideas on how I can identify the process generating these?

    Event Type: Success Audit
    Event Source: Security
    Event Category: Privilege Use
    Event ID: 576
    Date:  11/27/2012
    Time:  11:42:52 AM
    User:  NT AUTHORITY\NETWORK SERVICE
    Computer: [redacted]
    Description:
    Special privileges assigned to new logon:
      User Name: NETWORK SERVICE
      Domain:  NT AUTHORITY
      Logon ID:  (0x0,0x3E4)
      Privileges:  SeAuditPrivilege
       SeAssignPrimaryTokenPrivilege
       SeChangeNotifyPrivilege

    Event Type: Success Audit
    Event Source: Security
    Event Category: Logon/Logoff
    Event ID: 528
    Date:  11/27/2012
    Time:  11:42:52 AM
    User:  NT AUTHORITY\NETWORK SERVICE
    Computer: [redacted]
    Description:
    Successful Logon:
      User Name: NETWORK SERVICE
      Domain:  NT AUTHORITY
      Logon ID:  (0x0,0x3E4)
      Logon Type: 5
      Logon Process: Advapi 
      Authentication Package: Negotiate
      Workstation Name: 
      Logon GUID: -


    - Omar

    Tuesday, November 27, 2012 5:02 PM