Re: Event ID 560 (Object Name: \BaseNamedObjects\RasPbFile )

From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 06/16/03 

Date: Mon, 16 Jun 2003 14:16:16 -0700

You will not be able to decipher these; they require source code access.

Go to group policy or local security policy and disable the security option
"Audit the access of global system objects", and these events won't occur.
They are not operationally useful and don't indicate any malicious or
suspicous activity. The setting only exists to fulfill a Common Criteria
requirement.

Eric

"Jane Tunnicliff" <jtunn@uwpn.org> wrote in message
news:099a01c33041$2ab490f0$a001280a@phx.gbl...
> I am getting this error (below) on a Windows 2000 (sp3)
> server when I attempt to manually start a Cognos reporting
> application service (IWR). We have a local security
> policy template applied that seems to be triggering the
> audit event.
>
> Does anyone know what the \BaseNamedObjects\RasPbFile is?
> I am trying to establish the connection between this
> object access failure error message and the inability of
> the service to start.
>
> Thanks in advance for any insight on this error.
>
>
> Type Failure
> Event ID 560
> Object Open:
> Object Server: Security
> Object Type: Mutant
> Object Name: \BaseNamedObjects\RasPbFile
> New Handle ID: -
> Operation ID: {0,1149915}
> Process ID: 3052
> Primary User Name: Cognos_Service
> Primary Domain: UWPN_EPIC
> Primary Logon ID: (0x0,0xBA45)
> Client User Name: -
> Client Domain: -
> Client Logon ID: -
> Accesses DELETE
> READ_CONTROL
> WRITE_DAC
> WRITE_OWNER
> SYNCHRONIZE
> Query mutant state
>
> Privileges -
>