RE: Windows Event 560

From: dieter.scholtyssek@gsa.gov
Date: 05/03/02


To: jasmin.amidzic@abs.gov.au
From: dieter.scholtyssek@gsa.gov
Date: Fri, 3 May 2002 13:26:24 -0500


I currently have almost the same problem with one of my webservers.

Event ID: 560
Object Open:
     Object Server: Security
     Object Type: Event
     Object Name: \BaseNamedObjects\MSDTC_NAMED_EVENT
     New Handle ID: -
     Operation ID: {0,27056267}
     Process ID: 3496
     Primary User Name: WEBDOMAIN
     Primary Domain: mywebserver
     Primary Logon ID: (0x0,0x152808C)
     Client User Name: -
     Client Domain: -
     Client Logon ID: -
     Accesses DELETE
               READ_CONTROL
               WRITE_DAC
               WRITE_OWNER
               SYNCHRONIZE
               Query event state
               Modify event state

     Privileges -

The server is currently generating 2 errors per second.

Could anyone help with this...?

Thank you,

Dieter Scholtyssek
Dieter.Scholtyssek@gsa.gov

                                                                                                                      
                                                                                                                      
                    "Jas Amidzic" To: "Fallon, Benjamin" <bfallon@Businessedge.com>
                    <jasmin.amidzic@a cc: "'Calhoun, Heath'" <CalhounH@gsci.state.ms.us>,
                    bs.gov.au> security-basics@securityfocus.com, (bcc: Dieter
                                             Scholtyssek/CONTRACTOR/7BC/R07/GSA/GOV)
                    05/02/2002 06:23 Subject: RE: Windows Event 560
                    PM
                                                                                                                      
                                                                                                                      

Sorry for bit late response. I would even try to figure out the meaning of
the
event. Obviously you have REG KEY
HKLM\SYSTEM\CurrentControlSet\Control\LSA\AuditBaseObjects (REG_DWORD) set
to 1
if this is the case set the key to 0. Auditing base objects are of use to
no one
other than developers.

Jasmin

|--------+-------------------------->
| | "Fallon, |
| | Benjamin" |
| | <bfallon@Busines|
| | sedge.com> |
| | |
| | 24/04/2002 02:14|
| | AM |
| | |
|--------+-------------------------->
>
----------------------------------------------------------------------------|

  |
|
  | To: "'Calhoun, Heath'" <CalhounH@gsci.state.ms.us>,
|
  | security-basics@securityfocus.com
|
  | cc: (bcc: Jas Amidzic/Staff/ABS)
|
  | Subject: RE: Windows Event 560
|
>
----------------------------------------------------------------------------|

While a bit cryptic, here is the link to the TechNet Windows 2000 Security
Event Descriptions (Part 1 of 2) (Q299475)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q299475

Hope this helps a little.

Ben

-----Original Message-----
From: Calhoun, Heath [mailto:CalhounH@gsci.state.ms.us]
Sent: Monday, April 22, 2002 3:49 PM
To: security-basics@securityfocus.com
Subject: Windows Event 560

Hello. We are trying to figure out with no success the meaning of a
Windows
2000 error when running
the security audit.
We are running sp2 with the latest hotfixes. The error is event 560:
Security Event Log object access
\baseNamedObjects\RasPbFile
on reboot, it writes multiple entries.

Thanks.
Heath Calhoun

-----------------------------------------------
ABS Web Site: www.abs.gov.au



Relevant Pages

  • RE: Windows Event 560
    ... I assume RasPBFile means something to do with the RAS phone book ... Subject: Windows Event 560 ... We are running sp2 with the latest hotfixes. ... Security Event Log object access ...
    (Security-Basics)
  • RE: Windows Event 560
    ... Obviously you have REG KEY ... We are trying to figure out with no success the meaning of a Windows ... We are running sp2 with the latest hotfixes. ... Security Event Log object access ...
    (Security-Basics)
  • RE: Windows Event 560
    ... Subject: Windows Event 560 ... Auditing base objects are of use to no ... We are running sp2 with the latest hotfixes. ... Security Event Log object access ...
    (Security-Basics)
  • RE: Windows Event 560
    ... Subject: Windows Event 560 ... Obviously you have REG KEY ... We are running sp2 with the latest hotfixes. ... Security Event Log object access ...
    (Security-Basics)
  • RE: Windows Event 560
    ... supposedly there is a database of all MS Event IDs in the ... \support\tools directory on the Win2k CD. ... We are running sp2 with the latest hotfixes. ... Security Event Log object access ...
    (Security-Basics)