SeTcbPriviledge - Event 577

Hi Folks,

I have a Dell Latitude D630 notebook and snap it into a docking station at
work. My login account has full admin priviledges. My security log fills up
in a matter of a couple of hours. The only thing that makes this somewhat
bearable is the fact that my account is "admin" and I can logon to clear it.
It would be much worse otherwise.

The problem is realized whether or not the notebook is docked. That said, I
don't think the problem is domain-related. I'm thinking it has to be
something on the local machine. -- But what? And how do I fix it?

Here is the exact error (multiply by thousands every couple of hours)

Event Type: Failure Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 577
Date: 6/19/2009
Time: 9:37:13 AM
User: DomainName\john.doe
Computer: MyComputerName
Description:
Privileged Service Called:
Server: Security
Service: -
Primary User Name: john.doe
Primary Domain: DomainName.com
Primary Logon ID: (0x0,0x3041F)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeTcbPrivilege

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Thanks!

John

I am having this same exact issue, with the same setup (Dell laptop, docking
station).

Any ideas on what is causing this?

"johncp1962" wrote:

Hi Folks,

I have a Dell Latitude D630 notebook and snap it into a docking station at
work. My login account has full admin priviledges. My security log fills up
in a matter of a couple of hours. The only thing that makes this somewhat
bearable is the fact that my account is "admin" and I can logon to clear it.
It would be much worse otherwise.

The problem is realized whether or not the notebook is docked. That said, I
don't think the problem is domain-related. I'm thinking it has to be
something on the local machine. -- But what? And how do I fix it?

Here is the exact error (multiply by thousands every couple of hours)

Event Type: Failure Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 577
Date: 6/19/2009
Time: 9:37:13 AM
User: DomainName\john.doe
Computer: MyComputerName
Description:
Privileged Service Called:
Server: Security
Service: -
Primary User Name: john.doe
Primary Domain: DomainName.com
Primary Logon ID: (0x0,0x3041F)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeTcbPrivilege

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Thanks!

John