To resolve this behavior, grant the NETWORK SERVICE account the user rights that are described in the "Cause" section.
Note You can use the Secpol.msc Microsoft Management Console (MMC) snap-in to view the user rights that are in effect on the local computer.
If the server is not a domain controller, use Method 1 or Method 2. If the server is a domain controller, use Method 3 or Method 4.
Method 1: Grant the user rights in the Local Security Policy settings
To do this, follow these steps:
- Click Start, click Run, type Secpol.msc, and then click OK.
- In the Local Security Policy console, expand Local Policies, and then click User Rights Assignment.
- Double-click the Adjust memory quotas for a process user right.
- In the Properties dialog box, click Add User or Group.
- In the Select Users, Computers, or Groups dialog box, type NETWORK SERVICE under Enter the object names to select, and then click OK.
- In the Properties dialog box, click OK.
- Repeat step 3 through step 6 for the Generate security audits user right and for the Replace a process level token user right.
- Click Start, click Run, type Gpupdate, and then click OK.
Method 2: Grant the user rights in a Group Policy object (GPO) that is applied to member servers
To do this, follow these steps:
- Click Start, click Run, type Gpmc.msc, and then click OK.
- In the Group Policy Management console, expand Forest: DomainName, expand Domains, expand DomainName, expand Group Policy Objects, right-click the GPO that is applied to member servers, and then click Edit.
- In the Group Policy Management Editor console, expand Computer Configuration, expand Policies, expand Windows Settings, expand Security Settings, expand Local Policies, and then click User Rights Assignment.
- Double-click the Adjust memory quotas for a process user right.
- In the Properties dialog box, click Add User or Group.
- In the Add User or Group dialog box, type NETWORK SERVICE under User and group names, and then click OK.
- In the Properties dialog box, click OK.
- Repeat step 4 through step 7 to add the NETWORK SERVICE account for the Generate security audits user right and for the Replace a process level token user right.
- Click Start, click Run, type Gpupdate, and then click OK.
Method 3: Grant user rights in the Group Policy settings
To do this, follow these steps:
- Click Start, click Run, type Gpmc.msc, and then click OK.
- In the Group Policy Management console, expand Forest: DomainName, expand Domains, expand DomainName, expand Group Policy Objects, right-click Default Domain Controllers Policy, and then click Edit.
- In the Group Policy Management Editor console, expand Computer Configuration, expand Policies, expand Windows Settings, expand Security Settings, expand Local Policies, and then click User Rights Assignment.
- Double-click the Adjust memory quotas for a process user right.
- In the Properties dialog box, click Add User or Group.
- In the Add User or Group dialog box, type NETWORK SERVICE under User and group names, and then click OK.
- In the Properties dialog box, click OK.
- Repeat step 4 through step 7 to add the NETWORK SERVICE account for the Generate security audits user right and for the Replace a process level token user right.
- Click Start, click Run, type Gpupdate, and then click OK.
Method 4: Update the GptTmpl.inf file
To do this, follow these steps:
- In a text editor, such as Notepad, open the GptTmpl.inf file.
Note The GptTmpl.inf file is in the following folder:%systemroot%\SYSVOL\domain\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
- Update the user rights to the following default setting:
SeIncreaseQuotaPrivilege = *S-1-5-19,*S-1-5-20,*S-1-5-32-544
SeAuditPrivilege = *S-1-5-19,*S-1-5-20
SeAssignPrimaryTokenPrivilege =*S-1-5-19,*S-1-5-20
- Click Start, click Run, type Gpupdate, and then click OK.