CSA - Winlogon.exe causes rule 699 to fire

[agarciaiii]

I am seeing the following message: "The process 'C:\Windows\system32\winlogon.exe (as user NT Authority\System) attempted to modify a Cisco Service Agent resource Cisco process c:\Program Files\Cisco Systems\CSAgent\bin\leventmgr.exe. The Operation was denied." This firing rule was 699. I have also attached a screenshot of the firing rule details. Has anyone seen this before or have any ideas?

The alert is comming from the agent running on the MC, which appears to have been disabled.

[tsteger1]

My 5.2.210 MC had 4 of these messages.

They appeared to occur when I was connected via a terminal session and generated rules.

I haven't had any since I upgraded to 5.2.225.

Tom