Re: 565 Events
From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 04/29/03
- Next message: Eric Fitzgerald [MSFT]: "Re: Kerberos event logging (LogLevel registry value)"
- Previous message: Steven L Umbach: "Re: Event ID 1000"
- In reply to: Peter K.: "565 Events"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 28 Apr 2003 15:21:14 -0700
Then there is also a machine named PHILIP, because PHILIP$ refers to a
machine account.
Machine accounts, or at least the one in question, probably don't have
access to the object in question.
Eric
--
Eric Fitzgerald
Program Manager, Windows Auditing and Intrusion Detection
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"Peter K." <pmkdatabase@yahoo.ca> wrote in message
news:hpk6avsedqo6e9h5akjka3ulis6g165vtk@4ax.com...
> Hi,
>
> Any ideas on the cause/solution of these? I get them every now and
> then when logging on to a workstation. The logon is successful, but
> these events show up. The user name below (Philip) is the workstation
> name, not a human user.
>
> Thanks,
>
> Peter
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Directory Service Access
> Event ID: 565
> Date: 4/21/2003
> Time: 8:24:08 AM
> User: JOM\PHILIP$
> Computer: PMCI-01
> Description:
> Object Open:
> Object Server: DS
> Object Type: container
> Object Name: %{cdd69897-5971-448b-8a98-68e1e68bf28b}
> New Handle ID: -
> Operation ID: {0,25815628}
> Process ID: 268
> Primary User Name: PMCI-01$
> Primary Domain: JOM
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: PHILIP$
> Client Domain: JOM
> Client Logon ID: (0x0,0x189EA3F)
> Accesses List Contents
>
> Privileges -
>
> Properties:
>
- Next message: Eric Fitzgerald [MSFT]: "Re: Kerberos event logging (LogLevel registry value)"
- Previous message: Steven L Umbach: "Re: Event ID 1000"
- In reply to: Peter K.: "565 Events"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
