Take the 2-minute tour ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.

Somewhat of a strange one. Recently my user id's been showing up in a number of Audit Success records in the Security event log of one of our production database servers with the below content (or similar):

An operation was attempted on a privileged object.

Subject:
    Security ID:        myDomain\myUsername
    Account Name:        myUsername
    Account Domain:        myDomain
    Logon ID:        0x297c9c7af4

Object:
    Object Server:    SC Manager
    Object Type:    SC_MANAGER OBJECT
    Object Name:    ServicesActive
    Object Handle:    0xfffffa6012a44b18

Process Information:
    Process ID:    0x2f4
    Process Name:    C:\Windows\System32\services.exe

Requested Operation:
    Desired Access:    DELETE
            READ_CONTROL
            WRITE_DAC
            Connect to service controller
            Create a new service
            Enumerate services
            Lock service database for exclusive access
            Query service database lock state
            Set last-known-good state of service database

    Privileges:        SeTakeOwnershipPrivilege

This record appears about 40 times one second, then there's a few seconds without anything being logged before the next batch of ~40.

The events start appearing after I connect to a database hosted on the affected server from SSMS. I don't open a query window or do anything more than connect under my user account.

Disconnecting in SSMS does not stop the events. Exiting SSMS does.

Has anyone seen behavior like this before / any idea what may cause it?

Thanks in advance.

Version Info:

  • SSMS: 10.0.5512.0 (on OS 5.2.3790)

  • DB: Microsoft SQL Server 2008 (SP3) - 10.0.5794.0 (X64) Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.