Question about security logs

Learn about Computer Security General Security Questions and Comments
1

Today I noticed this in the event viewer:

Event ID:528
Source: Security
Type: Success Audit
Description: Successful Logon
User Name: Networkservice
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Logon Type: 5
Logon Process: Advapi
Authentication Package: Negotiate
Workstation Name:
Logon GUID:

and immediately followed by entries such as:

Event ID: 576
Source: Security
Type: Success Audit
Description: Special privileges assigned to new logon
User Name: Networkservice
Domain: NT AUTHORITY
Logon ID: (0x0,0x3E4)
Assigned: SeAuditPrivilege
SeAssignPrimaryTokenPrivilege
SeChangeNotifyPrivilege

as well as other entries saying “SeTakeOwnershipPrivilege”

It would seem to be related to wmiprsv/wbem, as log files in my wbem/logs folder are modified around that time.

FrameWork.log shows entries like “Device IO control returned unexpected error for Check verify: (1) 02/03/2013 02:15:07.937 thread:4580 [d:\xpsp\admin\wmi\wbem\providers\win32provider\providers\logicaldisk.cpp.747]”

Might anyone have any idea what these could imply, or how I could figure it out? Googling this does not give very clear answers, and mostly gives hits to server problems etc. I am not running any servers myself.

I’m using XP Pro SP3.

Thanks.

2

There’s nothing untoward happening with these. As you probably know, Windows runs a lot of background processes and these, just like a ‘normal’ user accounts, require access privileges to perform their tasks. The security log simply keeps track of these events as a matter of course. It’s also quite usual to see event IDs 526 and 576 back to back.