Event ID: 6033 Source: LsaSrv

Event ID/Source search

Keyword search

Example: Windows cannot unload your registry file

EventID.Net Splunk Add-on

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to www.eventid.net. The EventId.Net for Splunk Add-on assumes that Splunk is collecting information from Windows servers and workstation via the Splunk Universal Forwarder.

Event ID: 6033 Source: LsaSrv

Source: LsaSrv
Type: Error
Description: An anonymous session connected from <computer name or ip address> has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller. The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\TurnOffAnonymousBlock DWORD value to 1. This message will be logged at most once a day.
2 Comments for event id 6033 from source LsaSrv