DOCUMENT:Q268169  06-AUG-2002  [sms]
TITLE   :SMS: Audit of Successful Use of User Rights Creates Mult Entries
PRODUCT :Microsoft Systems Management Server
PROD/VER::2.0,2.0 SP1,2.0 SP2
OPER/SYS:
KEYWORDS:kbsms200

======================================================================
-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Systems Management Server versions 2.0, 2.0 SP1, 2.0 SP2 
-------------------------------------------------------------------------------

SUMMARY
=======

When you enable success auditing for "Use of User Rights" on Microsoft Windows
NT computers or you enable "Audit privilege use" on Microsoft Windows 2000
computers, numerous entries for the SMSCliSvcAcct& account or the
SMS&_DomainController account may be displayed in the security log. These
entries appear whenever the local client service account is used on the computer
and coincides with the 23 hour configuration interval for the Systems Management
Server (SMS) Client or the stop and subsequent restart of the SMS client
service.

MORE INFORMATION
================

The client service uses the SMS Client Service Account (SMSCliSvcAcct& or
SMS&_DomainController) to gain access to Windows NT and Windows 2000
computers. This account exists the entire time that the SMS Client software is
installed on the client. This account is automatically created during the SMS
client installation. This account must be a local Administrator and have the
following rights:

 - LogonAsService
 - ActAsPartOfOperatingSystem
 - ReplaceProcessLevelToken

NOTE: SMS automatically configures the above-referenced account with all of the
necessary rights. Not having these rights does not have an impact on security,
just functionality.



REFERENCES
==========

For additional information, click the article number below to view the article
in the Microsoft Knowledge Base:

   Q264769 Event ID 576 Fills the Security Event Log When Auditing

Additional query words: prodsms

======================================================================
Keywords          : kbsms200 
Technology        : kbSMSSearch kbSMS200 kbSMS200SP1 kbSMS200SP2
Version           : :2.0,2.0 SP1,2.0 SP2
Issue type        : kbinfo

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 2002.