Connecting Tech Pros Worldwide Forums | Help | Site Map

Windows Server 2003 System Event Error

Newbie
 
Join Date: Oct 2008
Location: NY/NJ Area
Posts: 1
#1: Oct 22 '08
I've got this error that I can't figure out - anyone out there have any idea as to what I can do to solve it? I've checked out sites, and Microsoft but can't seem to figure out where the call is coming from.

Error Message:

Severity: Major
Node: %Servername%
First Received: 10/16/2008 9:45:03 AM
Object: None
Last Received: 10/16/2008 9:45:05 AM
Application: LsaSrv
EventID: 0xC0001791 (6033) - An anonymous session connected from %Servername% has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller.
The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr ol\Lsa\
TurnOffAnonymousBlock DWORD value to 1.

NeoPa's Avatar
Administrator
 
Join Date: Oct 2006
Location: London - UK
Posts: 15,722
#2: Oct 27 '08

re: Windows Server 2003 System Event Error


I'd begin by googling "LsaSrv" and trying to determine what type of process may be issuing such requests.

If, when you better understand what it does, you cannot think of any processes that may legitimately want to make this request, you may want to consider that the node listed (%Servername%) may be infected with malware.
Reply