Recently, we started seeing a phenomenon where any machine running Microsoft Teams (office 365 E3 version) will emit event 4673 at a high rate, indicating a failed attempt to use the seProfileSingleProcessPrivilege. Counting one random second's worth of these entries, I saw 120. The volume of these audit failures is causing the security log to fill and overwrite so quickly that no valuable information can be retained.
By policy, we audit both success and failure on privilege use, so turning off audit is not an option. Granting the privilege to all users seems like a poor security practice as well.
I do not see chatter about this issue, so I am wondering if we are alone with this symptom.
I can't explain why Teams would be attempting to grant this privilege to itself.
We can't find any indications of compromise and have installed teams on a fresh laptop and see this symptom.
I would love to hear any ideas on how to convince Teams to stop this behavior.