Windows 10: Turn Off Auditing Event ID 4663 For Computer Account

Hello,


We are trying to reduce log volumes and we have a very noisy computer account that is generating millions of 4663 a day. I cannot for the life of me figure out a way to turn auditing off for this specific account and event. I tried looking in to SACL but couldn't find a way to properly do it. If anyone could please help guide me in how to do something like this it would be greatly appreciated.

:)

 

Event logs (and storage) filling up with Event 4663 due to HealthService.exe

I would like object access auditing turned on for an Azure VM running Windows Server 2016 (fully updated). This system potentially stores Private Health Information.

I noticed today that the disk space within the VM had essentially run out. I traced the problems to archived Security event logs. These logs are filling up with entries generated by HealthService.exe and an event ID of 4663 for accessing the registry.
Approximately 60 are generated every second, and I can watch the disk free space decline.

I have restarted the VM, but that did no good. I am turning off the object access auditing for now, but that is not the configuration I would like.

Is there a corruption? Has HealthService.exe been replaced by malware?

 

Windows 10 workstation Security log filling with Event ID 4703

My Windows 10 workstation's Security Event Log is filled with informational Event ID 4703 (like 20/second).

It's an Audit Success on Authorization Policy Change category.

Pretty much all are about the javaw.exe process & SeSecurityPrivilege. But also a few of them list svchost.exe as the process & a whole list of privileges.

I can't find anything on the Net about event 4703.

Sometimes it lists the privilege as Disabled (as below), and some are Enabled. Back & forth, multiple events per second.

Does anyone have any idea what/why this is, or anyone else experiencing it?

Here are the details of the event (edited for privacy)...

Task Category: Authorization Policy Change

Level: Information

Keywords: Audit Success

User: N/A

Computer: xxxxx.yyyy.com

Description:

A user right was adjusted.

Subject:

Security ID: SYSTEM

Account Name: XXXXXX

Account Domain: YYYYYYYY

Logon ID: 0x3E7

Target Account:

Security ID: SYSTEM

Account Name: XXXXXXX

Account Domain: YYYYYYYYY

Logon ID: 0x3E7

Process Information:

Process ID: 0xb24

Process Name: C:\Windows\SysWOW64\ContegoSPOP\jre1.7.0_65\bin\javaw.exe

Enabled Privileges:

-

Disabled Privileges:

SeSecurityPrivilege

 

Event ID 7036 not showing in Windows Event Log on Win10

It looks like 7036 event is missing from Windows desktop OS (starting from 8).
However you can monitor process termination:

1. Enable Audit Policy to audit process tracking:
   

1. Check for event 4689 in Security Event Log
   

Alternatively you may try this solution.

But in this case, you will get event 4546 not only when the service starts or stops, but whenever something is trying to access it (e.g. when Services applet is open).