Re: Data access and security permissions

From: Dan (meos1_at_excite.com)
Date: 08/05/03 

Date: Tue, 5 Aug 2003 07:01:46 -0700

Hi Norman,

Sounds like a real quandry. What version of IIS are you
running? I would try temporarily lowering the "application
protection" to "low" and see if this continues. If it
clears up you might try running the syncIWAM
adminnstrative script.

Dan
>-----Original Message-----
>Source : Security
>Category : Object Access
>Event ID : 560
>Type : Failure
>User : ANANSI\siteUser
>Computer : ANANSI
>
>Description :
>
>Object Open:
>Object Server: Security
>Object Type: File
>Object Name: C:\Inetpub
>New Handle ID: -
>Operation ID: {0,3075990}
>Process ID: 436
>Primary User Name: IWAM_ANANSI
>Primary Domain: ANANSI
>Primary Logon ID: (0x0,0x0A0A)
>Client User Name: siteuser
>Client Domain: ANANSI
>Client Logon ID: (0x0,0x0B0B00)
>Accesses SYNCHRONIZE
> ReadData (or ListDirectory)
>
>Privileges -
>
>
>
>On Tue, 5 Aug 2003 20:20:23 +1000, "Ken Schaefer"
><kenREMOVE@THISadOpenStatic.com> wrote:
>
>>Can you post an example of what you mean? (Event ID,
Source, Message)
>>
>>Cheers
>>Ken
>>
>>"Norman Beresford" <ng@anansi.co.uk> wrote in message
>>news:3uuuivsnlv41rk8b9h4pkenu3eitk25qac@4ax.com...
>>: Hi all
>>:
>>: Running a windows 2000 webserver with multiple ASP
driven websites on
>>: it. Each website has a private data directory, where
Access databases
>>: are stored. There's a user account for each website,
which has
>>: permissions to access the appropriate data directory.
>>:
>>: Now the problem I've got is that every time a site
accesses it's
>>: database directory I'm getting a security failure
error being thrown
>>: up. However these aren't permission errors on the
site database
>>: directory (and the ASP works fine), rather they're
showing attempts to
>>: access the parent directory for all the sites. this
occurs whether
>>: the ASP is using a DSN or DSNless connection.
>>:
>>: Does anyone have any ideas, as it's causing my
security log to fill up
>>: at a very high speed.
>>:
>>: Norman
>>
>
>.
>

Relevant Pages

  • Re: Event ID 560 Problem
    ... >Error 560s usually refer to object access. ... >whenever a user makes a connection to something out on ... >> this repeated event in my security log that I can't ... Whenever someone log off their workstation, ...
    (microsoft.public.win2000.security)
  • Re: Help!Am I being hacked?
    ... That is entirely normal to be seen in the security log for access to the local sam by ... NT AUTHORITY\SYSTEM when object access is enabled. ... for the administrator account. ... account can not be locked out to console logon. ...
    (microsoft.public.win2000.security)
  • auditing question - single file object access creates duplicate security log messages
    ... The multiple entries are a pain. ... >I would like to audit file access on my server. ... >get a multitude of messages in the security log every ... >I have enabled auditing of object access in the Local ...
    (microsoft.public.win2000.security)
  • Re: Event Viewer Getting Full
    ... auditing of object access must be enabled. ... http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml -- PsLogList to dump lof ... You can increase the size of the security log and by default it ... >> audit for only specific files and avoid using the users and everyone group to ...
    (microsoft.public.win2000.security)