Event ID 6033: LSA (LsaSrv)

JoeMcLutz · 13 May 2017

Hi.
Today two events 6033 appeared in my events log:

"An anonymous session connected from MY_COMPUTER has attempted to open an LSA policy handle on this machine. The attempt was rejected with STATUS_ACCESS_DENIED to prevent leaking security sensitive information to the anonymous caller.
The application that made this attempt needs to be fixed. Please contact the application vendor. As a temporary workaround, this security measure can be disabled by setting the \HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contr ol\Lsa\TurnOffAnonymousBlock DWORD value to 1.
This message will be logged at most once a day."

What's going on? I ran both Malwarebyter Anti-Rootkit and Anti-Malware but nothing has been found.

Thank you.

UPDATE: I noticed that, both times, Sandboxie was started (manually). Maybe it's caused by Sandboxie.

tugadugadid · 09 Mar 2019

I too am using sandboxie and I too suspected it may have been sandboxie, given it uses the user "anonamous logon"; I am not using any server, IIS or SQL software, and it tends to happen after loading firefox sandboxed. makes me curious if there is not some malware embedded in the sandbox. i never seen this before; it may be necessary to harden IPC a bit, or force sandboxie to allow only the browser, no third party exe or dll; i will contact sandboxie forum and see what they have to say.

JoeMcLutz · 10 Mar 2019

Ok, let me know please.
Thank You!