Excessive 560 events logged when turning on Object Access Audit



Help! Due to security regulations, I have to use object auditing. As a
result, I get a TON of event 560 failures. Sometimes to the tune of 30 or
more per minute. Is there any way to fix this without disabling auditing?

The errors usually appear for RasPbFile, and Crypt32LogoffEvent. What are
these events? How can I prevent them from appearing? And does enabling
Auditing of Global Objects actually provide useful information at all?

A million Thanks!
Gilbert
.



Relevant Pages

  • Re: How do I see who created a user/group/OU in W2k3 AD???
    ... objects then it is DS Object Auditing you need.) ... when and where need auditing. ... Herb Martin, MCSE, MVPhttp://www.LearnQuick.Com ... Event viewer or scripts that view the event logs or archives. ...
    (microsoft.public.windows.server.active_directory)
  • Re: How do I see who created a user/group/OU in W2k3 AD???
    ... objects then it is DS Object Auditing you need.) ... You can likely get the creation time (maybe with ADSIEdit) but the ... when and where need auditing. ... How can I view past stats on who created users/groups/OUs? ...
    (microsoft.public.windows.server.active_directory)
  • Re: How do I see who created a user/group/OU in W2k3 AD???
    ... objects then it is DS Object Auditing you need.) ... when and where need auditing. ... script I can run, a GUI tool I can use? ... Event viewer or scripts that view the event logs or archives. ...
    (microsoft.public.windows.server.active_directory)
  • Re: File Audit
    ... have deleted the file .I hope to kbow which user have modified and ... delete of the special fle ... You have to also enable File (i.e., OBJECT Auditing) in the Local ... Auditing of files and other objects requires TWO types of settings: ...
    (microsoft.public.windows.server.general)
  • Re: Failure Audit Security Log Event ID 577
    ... >Onr solution is to ease back on the events you are ... >of auditing it is usually to only log failures (not ... >The user right that the account is not being granted is ...
    (microsoft.public.windowsxp.security_admin)