Event Error 560: Accesses MAX_ALLOWED

From: Fyboo (Fyboo_at_hotmail.com)
Date: 10/08/04


Date: 8 Oct 2004 00:01:59 -0700

L.s.,

In the eventviewer I got audit failure messages 560.
----------------------------------------------------------------------
Object Server: Security
         Object Type: Key
         Object Name: \REGISTRY\USER\.DEFAULT
         Handle ID: -
         Operation ID: {0,42785055}
         Process ID: 1004
         Image File Name: C:\WINNT\system32\svchost.exe
         Primary User Name: servername$
         Primary Domain: Domain
         Primary Logon ID: (0x0,0x3E7)
         Client User Name: FS0002$
         Client Domain: Domain
         Client Logon ID: (0x0,0x3E7)
         Accesses: MAX_ALLOWED
                        
         Privileges: -
         Restricted Sid Count: 0
         Access Mask: 0x2000000
----------------------------------------------------------------------
I don't have any clue this behaviour occurs on my system. It has
nothing to do with starting Taskmanager, because the event occur also
at midnight. (and nobody is working at that moment)

So anybody?