Suspicious event log Event ID: 4905

hi thr,

could please me understand causing such event logs generate ?

as  i understand, vssvc.exe pertains volume shadow copy used backup purpose.  we have third party application used taking backup of servers.

the event longs generated following messages:

1) attempt made unregister security event source.

2) attempt made register security event source.

these events not regular generated on random days.

standard fields:
date:               2013/10/19
time:               02:32:19
importance:         critical
rule name:          security event
monitored machine:  <domain controller>
log format:         windows
log name:           security
event id:           4905
in work hours:      yes

dynamic fields:
internal timestamp: 2013/10/19 09:18:19.974
type:               success audit
isadmin:            no
source:             security-auditing
system time:        10/19/13 02:32:19
event record id:    499645946
category:           audit policy change
username:           
process id:         536
name:               microsoft-windows-security-auditing
guid:               54849625-5478-4994-a5ba-3e3b0328c30d
event source name:  
qualifiers:         
level:              0
task:               13568
sys opcode:         0
keywords:           0x8020000000000000
activity id:        
related activity id: 
thread id:          2344
channel:            security
computer:           <domain controller>
user sid:           
version:            0
subject user sid:   nt authority\system
subject user name:  domain controller$
subject domain name: <domainname>
subject logon id:   0x3e7
process name:       c:\windows\system32\vssvc.exe
audit source name:  vssaudit
event source id:    0x1022f145

thanks help.

regards,

bibhs

hi,

windows logs event, when application calls authzunregistersecurityeventsource , provides audit trail of applications report custom security events.  normal see event logged several built-in components of windows including iis , dfs-r.

---

we trying better understand customer views on social support experience, participation in interview project appreciated if have time.
helping make community forums great place.

Windows Server  >  Security