Event ID 578 kept filling my event log

ljCharlie · 09-30-2005, 07:49 AM

Will anyone help me diagnoze why I kept getting event id 578 on my security event log? This event log fills my event log in about 10 minutes of 500MB space. Is there to block this particular event log?

Oh, I should mention that this is our Windows 2003 DC sever.

Help is appreciated.

Chevy · 10-01-2005, 04:52 PM

Quote:

Originally Posted by ljCharlie

Will anyone help me diagnoze why I kept getting event id 578 on my security event log? This event log fills my event log in about 10 minutes of 500MB space. Is there to block this particular event log?

Oh, I should mention that this is our Windows 2003 DC sever.

Help is appreciated.

Event 578 is as Success Audit. You may be auditing an object that is accessed by everyone on your network.

What is the full text of the event?

ljCharlie · 10-04-2005, 09:17 AM

Many thanks for your response. Here's what the actual texts say.

Quote:

Event Type: Success Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 578
Date: 10/4/2005
Time: 10:17:21 AM
User: myDomain\johnsonj
Computer: myComputer1
Description:
Privileged object operation:
Object Server: Security
Object Handle: 304
Process ID: 4476
Primary User Name: johnsonj
Primary Domain: myDomain
Primary Logon ID: (0x0,0x6994E)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeTakeOwnershipPrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

So how do I not audit this particular event?

Chevy · 10-04-2005, 05:24 PM

You need to review the auditing settings on your file system (right click, select Properties, Auditing tab).

You've set either all files or folders, or at least some, to report successful access (opwnership changes, permissions changes, etc.)

ljCharlie · 10-10-2005, 07:00 AM

Where do I "right click, select Properties, Auditing tab"? Are you reffering to the "Default Domain Controllers Security Settings/Local Policies/Audit Policy and/or Default Domain Security Settings/Local Policies/Audit Policy"? If this is what you're talking about then I already tried turn everything in these two location and still receiving this event log.

Chevy · 10-11-2005, 01:28 PM

Right click on each drive (in My Computer view) and select Poprties->Security, then click on the Advanced button and check the Auditing tab.

ljCharlie · 10-13-2005, 06:56 AM

I only have one drive, C drive, and there is nothing listed in the Auditing tab. So where else can I check now to turn off this particular event id?

ljCharlie · 10-26-2005, 07:37 AM

So does anyone have a solution or an idea on how to resovle this issue? My security log fills up so quickly with this event id 578 that it does not have any space to log other events.

09-30-2005, 07:49 AM	#1 (permalink)
ljCharlie Registered User Join Date: May 2003 Posts: 64 OS: PC	Event ID 578 kept filling my event log Will anyone help me diagnoze why I kept getting event id 578 on my security event log? This event log fills my event log in about 10 minutes of 500MB space. Is there to block this particular event log? Oh, I should mention that this is our Windows 2003 DC sever. Help is appreciated. Last edited by ljCharlie; 09-30-2005 at 07:50 AM.

10-04-2005, 05:24 PM	#4 (permalink)
Chevy Retired Join Date: Jul 2003 Location: Notlob Posts: 5,452 OS: Vista Ultimate My System	You need to review the auditing settings on your file system (right click, select Properties, Auditing tab). You've set either all files or folders, or at least some, to report successful access (opwnership changes, permissions changes, etc.)

10-10-2005, 07:00 AM	#5 (permalink)
ljCharlie Registered User Join Date: May 2003 Posts: 64 OS: PC	Where do I "right click, select Properties, Auditing tab"? Are you reffering to the "Default Domain Controllers Security Settings/Local Policies/Audit Policy and/or Default Domain Security Settings/Local Policies/Audit Policy"? If this is what you're talking about then I already tried turn everything in these two location and still receiving this event log.

10-11-2005, 01:28 PM	#6 (permalink)
Chevy Retired Join Date: Jul 2003 Location: Notlob Posts: 5,452 OS: Vista Ultimate My System	Right click on each drive (in My Computer view) and select Poprties->Security, then click on the Advanced button and check the Auditing tab.

10-13-2005, 06:56 AM	#7 (permalink)
ljCharlie Registered User Join Date: May 2003 Posts: 64 OS: PC	I only have one drive, C drive, and there is nothing listed in the Auditing tab. So where else can I check now to turn off this particular event id?

10-26-2005, 07:37 AM	#8 (permalink)
ljCharlie Registered User Join Date: May 2003 Posts: 64 OS: PC	So does anyone have a solution or an idea on how to resovle this issue? My security log fills up so quickly with this event id 578 that it does not have any space to log other events.