failure audit - directory service acces - event id 565

From: Joe Cave (Joe@tendocom.com)
Date: 09/26/02 

From: "Joe Cave" <Joe@tendocom.com>
Date: Wed, 25 Sep 2002 16:38:28 -0700

i have directory service access auditing turned on and i get keep getting
flooded with this error:

Event Type: Failure Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 565
Date: 9/25/2002
Time: 4:22:01 PM
User: MYDOMAIN\EXCHANGE1$
Computer: DC1
Description:
Object Open:
  Object Server: DS
  Object Type: configuration
  Object Name: CN=Configuration,DC=mydomain,DC=org
  New Handle ID: -
  Operation ID: {0,1756529}
  Process ID: 264
  Primary User Name: DC1$
  Primary Domain: MYDOMAIN
  Primary Logon ID: (0x0,0x3E7)
  Client User Name: EXCHANGE1$
  Client Domain: MYDOMAIN
  Client Logon ID: (0x0,0x1ACD65)
  Accesses Control Access

  Privileges -

 Properties:
READ_CONTROL
Create Child
Delete Child
List Contents
Write Self
Delete Tree
  Manage Replication Topology

what's going on here? "exchange1" is exchange2000 server and "dc1" is a dc
obviously. everything is up to date with patches (sp3 for win and exchange +
misc patches). the process id listed is 264 which is lsass.exe.

any help is appreciated.

- j

Relevant Pages

  • Re: Event ID 565
    ... > Client User Name: GANDALF$ ... >> Event Type: Failure Audit ... >> Event Category: Directory Service Access ... >> Primary Logon ID: ...
    (microsoft.public.win2000.security)
  • Re: Event ID 565
    ... Client User Name: GANDALF$ ... > Event Type: Failure Audit ... > Event Category: Directory Service Access ... > Primary Logon ID: ...
    (microsoft.public.win2000.security)