Audit Privilege Use
You can use the Privilege Use category to track the exercise of user rights. Microsoft uses the terms privilege, right, and permission inconsistently. In this case, privileges refer to the user rights you find in Local Security Policy under Security Settings\Local Policies\User Right Assignment, as Figure 10‑1 shows.
Figure 10‑1 User rights configuration
Event
ID |
Type |
Description |
576 |
Success |
Special privileges assigned to new logon |
577 |
Success
Failure |
Privileged service called |
578 |
Success
Failure |
Privileged object operation |
Figure 10‑2 lists the three events in the Privilege Use category.
Event
ID |
Type |
Description |
576 |
Success |
Special privileges assigned to new logon |
577 |
Success
Failure |
Privileged service called |
578 |
Success
Failure |
Privileged object operation |
Figure 10‑2 Privilege Use events
More information on this audit category is available in WinSecWiki
This is just a fraction of the wealth of information available only in Randy Franklin Smith's eBook, The Windows Server Security Log Revealed.
|
