Blocked O/s Privileges : 4fd Options

[Johnnie]

I think this must be related at least, for one its trying to logon with the computer account (Primary User Name: TestPC$)

I'll foward onto EB :)

[patopoco]

Appreciate it Johnnie. B)

Sounds like a job for Jimmy Neutron. Hope he's on the payroll. :D

[Wolf]

@Johnnie

If you go into your "Local Security Policy" from the Administrative tools, and then in the left viewer pane, expand "Local Policies" and select "User Rights Assignment" - in the right viewer pane, there's an option called "Increase Scheduling Priority", add your test user to this policy then logoff and login again and see if it goes away.

@Patocopo
Microsoft states that this error is generated when 3 conditions are met, and that SP2 solves this "know problem". The other option if you don't want to install SP2, is to turn off audit policy changes. More info here:

• Event ID 577 appears repeatedly in the security event log of your Windows XP-based computer

[Johnnie]

@Johnnie

If you go into your "Local Security Policy" from the Administrative tools, and then in the left viewer pane, expand "Local Policies" and select "User Rights Assignment" - in the right viewer pane, there's an option called "Increase Scheduling Priority", add your test user to this policy then logoff and login again and see if it goes away.

Still the same.

[patopoco]

I'm using win2k pro and am all updated and such.

Good info though, Wolf. (Only briefly read it at this point.) I'll continue to investigate and report any other findings of note.

In the mean time, somebody come up with a wonder cure. :blink:

[Sturm]

I only get the 560 failure:

SeIncreaseBasePriorityPrivilege can be granted to users in Local Security Settings as "Increase Scheduling Priority" , but this does not solve the basic problem.

PB is accessing the Services Controller Service with more rights asserted than are owned. This results in Event 560. Then something tries 5 times to increase Priority Privilege, resulting in Event 577.

Not sure if it is possible to give users more Service Controller Service rights.

edit: darn, Wolf was too fast...

This post has been edited by Sturm: 7 Mar 2005, 10:27 PM

[Goldfish]

This means that PB is not able to access IoCreateFile and IoCreateService functions in your computer to install PB's Device Driver

So if(!IoCreateFile == NULL)
{
//Blocked OS Priv
}

[Johnnie]

Due to the complexity of this issue, PunksBusted.com are unable to troubleshoot this issue and you are advised to log a Web Ticket with Even Balance direct, please see here for more details: http://www.punksbusted.com/forums/index.php?showtopic=6198