Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Somewhat of a strange one. Recently my user id's been showing up in a number of Audit Success records in the Security event log of one of our production database servers with the below content (or similar):

An operation was attempted on a privileged object.

    Security ID:        myDomain\myUsername
    Account Name:        myUsername
    Account Domain:        myDomain
    Logon ID:        0x297c9c7af4

    Object Server:    SC Manager
    Object Type:    SC_MANAGER OBJECT
    Object Name:    ServicesActive
    Object Handle:    0xfffffa6012a44b18

Process Information:
    Process ID:    0x2f4
    Process Name:    C:\Windows\System32\services.exe

Requested Operation:
    Desired Access:    DELETE
            Connect to service controller
            Create a new service
            Enumerate services
            Lock service database for exclusive access
            Query service database lock state
            Set last-known-good state of service database

    Privileges:        SeTakeOwnershipPrivilege

This record appears about 40 times one second, then there's a few seconds without anything being logged before the next batch of ~40.

The events start appearing after I connect to a database hosted on the affected server from SSMS. I don't open a query window or do anything more than connect under my user account.

Disconnecting in SSMS does not stop the events. Exiting SSMS does.

Has anyone seen behavior like this before / any idea what may cause it?

Thanks in advance.

Version Info:

  • SSMS: 10.0.5512.0 (on OS 5.2.3790)

  • DB: Microsoft SQL Server 2008 (SP3) - 10.0.5794.0 (X64) Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2)

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.