I receive the following entry in my event log:Event Type: Failure AuditEvent Source: SecurityEvent Category: Privilege UseEvent ID: 577 ...Privileged Service Called:...Privileges: SeTcbPrivilege This log entry occurs frequently (sometimes every minute or every second) on XP SP2 or XP SP3 systems. This fills up people's logs. Q1: Is there a way to determine which process is causing this?Q2: What is the SeTcbPrivilege?Q3: Is SeTcbPrivilege worthy of being audited [via Audit Privilege Use : Success / Failure] as a best practice? We've already referred to these but they haven't been very helpful:MSKB 238185 : Not useful as it pertains to NT onlyMSKB 831905 : Not useful as it pertains to XP SP1 Thank you.8 people need an answerI do too

I have some users with the same thing going on and found the exact same things you did when searching.

It might be something to do with McAfee - see this link: Event ID 577 (displayed on client after installing McAfee Agent 4.5)(http://www.radzlair.com/2010/09/event-id-577-displayed-on-client-after-installing-mcafee-agent-4-5/)Rgrds Peter