This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Windows 10, too many event 4799 log

Hello all,

I am using Sophos Endpoint Security and Control ver. 10.7 on Windows 10.

My problem is that Event Viewer of Windows records the log of Event 4799 from SavService.exe every few seconds, and the list of logs is almost filled with these events.

This phenomenon happens when the window of Sophos Endpoint Security and Control is active.

Does anyone experience this problem, or know remedies?

Thank you for your time.

This thread was automatically locked due to age.

0 QC over 7 years ago

Hello SU,

every few seconds isn't normal. All events identical - SavService.exe enumerating the SophosAdministrator group? Checked on one machine and there the event is logged every 15 minutes or so.

Christian
Cancel
Vote Up 0 Vote Down

Cancel
0 S U over 7 years ago in reply to QC

Hello QC,

Thank you for your helpful information. This might be a specific issue on my machine.

On my machine, the recorded message is "A security-enabled local group membership was enumerated."

Security ID:        MACHINENAME\SophosAdministrator
Group name:       SophosAdministrator

Process name:        SavService.exe

(cf. https://docs.microsoft.com/en-us/windows/device-security/auditing/event-4799)

SU
Cancel
Vote Up 0 Vote Down

Cancel