Windows Security Log Events by ID

This event indicates that the specified user exercised the user right specified in the Privileges field. To understand Primary and User fields see event 560.

Some user rights are logged by this event - others by 577. Still other, "high-volume" rights are not logged when they are exercised but simply noted as being held by a user at the time th user logs by event 576.

On Windows Server 2000, this event is logged for the "SeSecurityPrivilege" whenever the security log is viewed or cleared because these operations require the use of the "Manage auditing and security log right" (aka SeSecurityPrivilege). For some reason Windows Server 2003, in the same situation, does not log this event. Occurrences for SeTakeOwnershipPrivilege also appear however the object handle can't be found in any other events in the log so there is no way to identify the object that the "client" user took ownership of. Likewise, Windows Server 2003 does not log this event.

Note: 576, 577 and 578 do not log any activity associated with LogonRights such as the SeNetworkLogonRight.

Do not confuse 576, 577 or 578 with events 608, 609, 620 and 621 which document rights assignment changes as opposed to the exercise of rights which is the purpose of 576, 577 and 578.

Microsoft's Comments:

These are high volume events, which typically do not contain sufficient information to act upon since they do not describe what operation occurred.