Somewhat of a strange one. Recently my user id's been showing up in a number of Audit Success records in the Security event log of one of our production database servers with the below content (or similar):
An operation was attempted on a privileged object. Subject: Security ID: myDomain\myUsername Account Name: myUsername Account Domain: myDomain Logon ID: 0x297c9c7af4 Object: Object Server: SC Manager Object Type: SC_MANAGER OBJECT Object Name: ServicesActive Object Handle: 0xfffffa6012a44b18 Process Information: Process ID: 0x2f4 Process Name: C:\Windows\System32\services.exe Requested Operation: Desired Access: DELETE READ_CONTROL WRITE_DAC Connect to service controller Create a new service Enumerate services Lock service database for exclusive access Query service database lock state Set last-known-good state of service database Privileges: SeTakeOwnershipPrivilege
This record appears about 40 times one second, then there's a few seconds without anything being logged before the next batch of ~40.
The events start appearing after I connect to a database hosted on the affected server from SSMS. I don't open a query window or do anything more than connect under my user account.
Disconnecting in SSMS does not stop the events. Exiting SSMS does.
Has anyone seen behavior like this before / any idea what may cause it?
Thanks in advance.
SSMS: 10.0.5512.0 (on OS 5.2.3790)
DB: Microsoft SQL Server 2008 (SP3) - 10.0.5794.0 (X64) Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)