Auditing Failure:
In all sharepoint 2013 servers in event viewer's security section below error found as many times nearly 50,000.
what is the cause for this error and how to solve this error do not come again, in our servers we installed symantec antivirus.
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 9/1/2015 10:59:48 AM
Event ID: 4673
Task Category: Sensitive Privilege Use
Level: Information
Keywords: Audit Failure
User: N/A
Computer: PortalBI.portal.com
Description:
A privileged service was called.
Subject:
Security ID:
PORTAL\spadmin
Account Name:
spadmin
Account Domain:
PORTAL
Logon ID:
0xE8A61B
Service:
Server: Security
Service Name: -
Process:
Process ID: 0x3470
Process Name: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.4100.4126.105\Bin\ccSvcHst.exe
Service Request Information:
Privileges:
SeTcbPrivilege
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4673</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13056</Task>
<Opcode>0</Opcode>
<Keywords>0x8010000000000000</Keywords>
<TimeCreated SystemTime="2015-09-01T07:59:48.322800600Z" />
<EventRecordID>19634466</EventRecordID>
<Correlation />
<Execution ProcessID="568" ThreadID="576" />
<Channel>Security</Channel>
<Computer>PortalBI.portal.com</Computer>
<Security />
</System>
<EventData>
<Data Name="SubjectUserSid">S-1-5-21-681022615-1803309023-368063384-1312</Data>
<Data Name="SubjectUserName">spadmin</Data>
<Data Name="SubjectDomainName">PORTAL</Data>
<Data Name="SubjectLogonId">0xe8a61b</Data>
<Data Name="ObjectServer">Security</Data>
<Data Name="Service">-</Data>
adil