Win - OIB - SC - Device Security - D - User Rights - v3.7 - warning in event log

[Neonsun77]

Ref #135 we are getting a warning event in the DeviceManagement-Enterprise-Diagnostics-Provider/Admin log with Event ID 4116: "UserRights account SID not mapped to account. UserRight: SeImpersonatePrivilege, SID: *S-1-5-99-216390572-1995538116-3857911515-2404958512-2623887229" - is this to be expected?

All endpoints are running Win 11 25H2 (Pro or Enterprise). We have added Windows Protected Print to the printing policy so I'm a bit hesitant to remove it since, as per the recommendations it seems to be related to that. Do we just ignore the warning?

[SkipToTheEndpoint]

Hey @Neonsun77
Indeed, that SID relates to the RESTRICTED SERVICES\PrintSpoolerService that was added into that group by default in 25H2. MS have also added that SID into their built-in 25H2 baseline too.

As for seeing those errors in the Event Log, that's curious as I can't see any in my available environment. Are you sure the device is on 25H2?