Windows Security Log Events by ID: Event ID 577

Windows Security Log Events by ID

look up more events by Event ID or Category

Event ID

577

Title

Privileged Service Called

Type:

Example:

Randy's Comments:

Success
Failure

OS:

All versions

Category:

Privilege Use

Privileged Service Called:
Server:Security
Service:-
Primary User Name:administrator
Primary Domain:ELMW2
Primary Logon ID:(0x0,0x804C2)
Client User Name:-
Client Domain:-
Client Logon ID:-
Privileges:SeSystemtimePrivilege

Event 577 indicates that the specified user exercised the user right specified in the Privileges field. To understand Primary and User fields see event 560.

Some user rights are logged by this event - others by 578. Still other, ""high-volume"" rights are not logged when they are exercised but simply noted as being held by a user at the time th user logs by event 576.

Click here for a cross reference of Se[privilege names] translated to user right names:

Note: 576, 577 and 578 do not log any activity associated with LogonRights such as the SeNetworkLogonRight.

Do not confuse events 576, 577 or 578 with events 608, 609, 620:Win2K 620:Win2k3, 621 which document rights assignment changes as opposed to the exercise of rights which is the purpose of events 576, 577 or 578.

Microsoft's Comments:

These are high volume events, which typically do not contain sufficient information to act upon since they do not describe what operation occurred.

Top 10 Most Important Events to Monitor

Windows Security Log Events by ID

577

Privileged Service Called

Upcoming Webinars by Randy Franklin Smith

Additional Links