What does SCCM 2012 use its ComputerAccount$ for?

Question

After a fresh install of SCCM 2012 SP1. Single server single site with a local SQL 2012 install.
(this is my first time setting this up 2012 and i was trying to do it textbook)
I started getting Alerts on my domain controllers.
No i have not done a client push yet but i have set up discovery.
Here is the error.
EVENT LOG
Security
EVENT TYPE
Audit Failure
SOURCE
Microsoft-Windows-Security-Auditing
CATEGORY
File Share
EVENT ID
5140
COMPUTERNAME  
DC04
DATE / TIME  
3/02/2014 9:52:13 am
MESSAGE
A network share object was accessed. Subject: Security ID: DOMAIN\SCCM$ Account Name: SCCM$ Account Domain: DOMAIN Logon ID:  Network Information: Object
Type: File Source Address: My Sccm Server IP Source Port: 52442 Share Information: Share Name:
\\*\ADMIN$ Share Path: \??\C:\Windows Access Request Information: Access Mask: 0x1 Accesses: ReadData (or ListDirectory)
Got these on my 3 DC's around the same time, Since these are DC's do i have to grant the computer account domain admin access?

Answer 1

All services in ConfigMgr run as the local System account of the server that they are on. The local System account in turn uses the computer's AD account to access any network resources. There are multiple processes within ConfigMgr that try to access
remote resources. Based on the message you have above, I would say this is coming from automatic (or manual) client push as this attempts to connect to the admin$ share.
Jason | http://blog.configmgrftw.com