I have noticed that since applying KB2419632 on patch Tuesday (only this and MRT were applied) that I have recurring identical event id 577 security audit failures which seem to occur just prior to hibernating.

Looking at the Microsoft knowledge base here (http://support.microsoft.com/kb/831905) I see reference to a pre-XP SP2 problem for which there is a hotfix available.

The problem is that this fix should already be applied as I have SP3 installed so I'm not convinced that the cause can be the same problem. Other online sources seem to suggest these failures are not important, but as the failures seem to be due to a different problem to that shown on the MS website I'm not convinced of this either.

My question is this:
How can I locate the source of these audit failures and does anyone have any further information to help me understand their significance or even a solution to stop them occurring?

TIA for any help you can give.


Bunny :)

PS: Forgot to mention I'm running Win XP Pro with all patches up to date.

Here is a copy of the event log entry...
(I have replaced any identity details with x's)

Event Type: Failure Audit
Event Source: Security
Event Category: Privilege Use
Event ID: 577
Date: 13/01/2011
Time: 22:23:30
User: xxxxxxxxxxx\xxxxxxxxx
Computer: xxxxxxxxxxx
Privileged Service Called:
Server: Security
Service: -
Primary User Name: xxxx xxxxxx
Primary Domain: xxxxxxxxxxxx
Primary Logon ID: (0x0,0x2A51F)
Client User Name: -
Client Domain: -
Client Logon ID: -
Privileges: SeTcbPrivilege

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Hmmm..It seems that these errors have nothing to do with patch Tuesday's updates. I have discovered that the event id 577s are being caused by a flight sim (orbiter 2006). I think the program name (2006) might be the clue - helplessly out of date.

Bunny :)

Just a quick update:
I have downloaded Orbiter 2010, the most up-to-date version, and the event id 577s still occur but not as often. Does anyone know how I might stop them occurring when Orbiter seems to be requesting an elevation of priviledge?

Any assstance would be gratefully recieved.