Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Event viewer - special Logon - NT Authority


  • Please log in to reply
4 replies to this topic

#1 Darktune

Darktune

    Very Purple


  • Members
  • 1,139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Wales
  • Local time:07:33 AM

Posted 16 June 2013 - 05:36 AM

Hello, 

 

I turned my PC on this morning and I was logged onto a temporary profile and was a bit confused, so I logged off and logged into my normal user account.

 

Then i started wondering why It did it so i went into event viewer and noted under security there were a lot of unusual logs some what like this

 

Keywords           Date & Time                 Source                                Event ID       Task category

 

Audit success - 16/03/2013 10:19:52 - Microsoft security Auditing - 4672 -      Special logon

 

I have a lot of these and when I click event properties it says the following

 
Special privileges assigned to new logon.
 
Subject:
Security ID: LOCAL SERVICE
Account Name: LOCAL SERVICE
Account Domain: NT AUTHORITY
Logon ID: 0x3e5
 
Privileges: SeAssignPrimaryTokenPrivilege
SeAuditPrivilege
SeImpersonatePrivilege

 

 

I'm not that good with computers so please can someone explain what this is? I am extremely paranoid when it comes to spyware and malware etc.. but I have Comodo firewall install as well as various other firewalls. 

 

Craig

 

 

 


It's very hard to imagine all the crazy things that things really are like. 

Electrons act like waves.. no they don't exactly, they act like particles.. no they don't exactly.

Words and ideas can change the world.


BC AdBot (Login to Remove)

 


#2 dc3

dc3

    Bleeping Treehugger


  • Members
  • 30,366 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Sierra Foothills of Northern Ca.
  • Local time:11:33 PM

Posted 16 June 2013 - 07:50 AM

This article explains what this is.


Family and loved ones will always be a priority in my daily life.  You never know when one will leave you.

 

 

 

 


#3 Darktune

Darktune

    Very Purple

  • Topic Starter

  • Members
  • 1,139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Wales
  • Local time:07:33 AM

Posted 16 June 2013 - 08:26 AM

This article explains what this is.

Thank you for replying dc3,

 

what you sent me explains what audit sensitive privileges are, I was wondering what NT authority is doing there

 

Thank you


It's very hard to imagine all the crazy things that things really are like. 

Electrons act like waves.. no they don't exactly, they act like particles.. no they don't exactly.

Words and ideas can change the world.


#4 Queen-Evie

Queen-Evie

    Official Bleepin' G.R.I.T.S. (and proud of it)


  • Staff Emeritus
  • 16,485 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:My own little corner of the universe (somewhere in Alabama). It's OK, they know me here
  • Local time:01:33 AM

Posted 17 June 2013 - 06:47 PM

NT Authority\SYSTEM a.k.a LocalSystem account is a built-in Windows Account. It is the most powerful account on a Windows local instance (More powerful than any admin account).

Most of the System level (Windows Services) services and some other 3rd party services run in the account. You do not have to worry anything about it.

http://superuser.com/questions/471769/what-is-the-nt-authority-system-user



#5 Darktune

Darktune

    Very Purple

  • Topic Starter

  • Members
  • 1,139 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Wales
  • Local time:07:33 AM

Posted 17 June 2013 - 06:49 PM

Thank you Queen-Evie. You've been a great help


It's very hard to imagine all the crazy things that things really are like. 

Electrons act like waves.. no they don't exactly, they act like particles.. no they don't exactly.

Words and ideas can change the world.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users