SeTcbPrivilege Error Running C++ App on Windows

[nlong]

Hi All,

I am having an issue with Windows Security Logging a Sensitive Privilege Use on windows. The application is logging an error in the security log whenever the app tries to access the phidget library. Any thoughts on how to tell windows that phidgets are a trusted device?

Thanks,
Nick


EventData
SubjectUserSid S-1-5-21-2090949127-153249958-1489575960-8167
SubjectUserName xxxx
SubjectDomainName xxxx
SubjectLogonId 0xcf1765e
ObjectServer Security
Service -
PrivilegeList SeTcbPrivilege
ProcessId 0x4b8
ProcessName C:\Program Files (x86)\xxx.exe

[eo825]

Nearly 8 years later, encountering this problem too. Windows 10 Pro, v1909

We are required to have this Windows security policy enabled (see Windows' gpedit.msc):
Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Audit Policy -> Audit Privilege use = "Success, Failure"

This causes event ID 4673 to be logged in the Windows event log system, failing while trying to use "SeTcbPrivilege". In my case there are nearly 30 of these events logged per second!!

The offending application is our VC++ 10 executable, which uses the Phidgets21 library, release date 2019-11-06. Currently don't have the Phidgets21 control panel or web service installed, just using the windevel package, running as an Admin user, but without elevated rights.

[eo825]

I forgot to mention that this happens whether or not a USB Phidget device is attached.

I've since installed the Phidgets applications. Phidgets21Manager.exe also causes these Windows security auditing events to be logged, at a similar rate, about 28/second. Also happens when Phidgets21Manager.exe is running with elevated privileges (by launching Phidget control panel as administrator)

Windows event content:
---------------------
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 6/11/2020 4:49:59 PM
Event ID: 4673
Task Category: Sensitive Privilege Use
Level: Information
Keywords: Audit Failure
User: N/A
Computer: xxxx
Description:
A privileged service was called.

Subject:
Security ID: xxxx
Account Name: xxxx
Account Domain: xxxx
Logon ID: 0x5E8CE

Service:
Server: Security
Service Name: -

Process:
Process ID: 0xb54
Process Name: C:\Program Files\Phidgets\Phidget21Manager.exe

Service Request Information:
Privileges: SeTcbPrivilege


---------------------

On a positive note, the Phidget22 software doesn't seem to have this issue, at least not when just using the Phidget control panel.

I haven't yet tried stepping our application to Phidget 22.

[Patrick]

Interesting that phidget22 doesn't have this issue. I'll try to track down what is happening in phidget21.

-Patrick