Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Somewhat of a strange one. Recently my user id's been showing up in a number of Audit Success records in the Security event log of one of our production database servers with the below content (or similar):

An operation was attempted on a privileged object.

Subject:
    Security ID:        myDomain\myUsername
    Account Name:        myUsername
    Account Domain:        myDomain
    Logon ID:        0x297c9c7af4

Object:
    Object Server:    SC Manager
    Object Type:    SC_MANAGER OBJECT
    Object Name:    ServicesActive
    Object Handle:    0xfffffa6012a44b18

Process Information:
    Process ID:    0x2f4
    Process Name:    C:\Windows\System32\services.exe

Requested Operation:
    Desired Access:    DELETE
            READ_CONTROL
            WRITE_DAC
            Connect to service controller
            Create a new service
            Enumerate services
            Lock service database for exclusive access
            Query service database lock state
            Set last-known-good state of service database

    Privileges:        SeTakeOwnershipPrivilege

This record appears about 40 times one second, then there's a few seconds without anything being logged before the next batch of ~40.

The events start appearing after I connect to a database hosted on the affected server from SSMS. I don't open a query window or do anything more than connect under my user account.

Disconnecting in SSMS does not stop the events. Exiting SSMS does.

Has anyone seen behavior like this before / any idea what may cause it?

Thanks in advance.

Version Info:

  • SSMS: 10.0.5512.0 (on OS 5.2.3790)

  • DB: Microsoft SQL Server 2008 (SP3) - 10.0.5794.0 (X64) Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.