Event ID 560

From: GeebMan (anonymous_at_discussions.microsoft.com)
Date: 12/08/03 

Date: Mon, 8 Dec 2003 08:55:45 -0800

I have an XP workstation that is getting this recurring
event in the security log. It gets it about twice every
second and is filling up the log. This just started
occuring a few days ago and it is the only workstation
that is registering this error. All other WS in the
domain are fine. Any ideas...

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 12/8/2003
Time: 9:58:41 AM
User: XXXX\XXXXXXXXXX
Computer: XXX_XX
Description:
Object Open:
         Object Server: Security
         Object Type: File
         Object Name: \Device\NetBT_Tcpip_{E0F71A16-
D997-4C0B-A60C-8488C7C6DFE9}
         Handle ID: -
         Operation ID: {0,1434186}
         Process ID: 700
         Image File Name: C:\WINDOWS\EXPLORER.EXE
         Primary User Name: XXXXXXX
         Primary Domain: XXXX
         Primary Logon ID: (0x0,0x57A54)
         Client User Name: -
         Client Domain: -
         Client Logon ID: -
         Accesses: SYNCHRONIZE
                        ReadData (or ListDirectory)
                        WriteData (or AddFile)
                        
         Privileges: -
         Restricted Sid Count: 0

Relevant Pages

  • Re: a forensic question
    ... > findstring then do the same for any network drive access they have. ... > it the slave on a machine with Easy Recovery Pro installed. ... But she discovered that some important files on her workstation ... >> security log of the PDC? ...
    (comp.security.misc)
  • Re: Why are my workstations changing their passwords?
    ... One question about the machines, are they cloned without sysprepping them? ... single workstation every 1-2 minutes. ... Always test ANY suggestion in a test environment before ... in the security log on all domain controllers for Event 565. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Event ID 560 Problem
    ... >Error 560s usually refer to object access. ... >whenever a user makes a connection to something out on ... >> this repeated event in my security log that I can't ... Whenever someone log off their workstation, ...
    (microsoft.public.win2000.security)
  • Event ID 537- NTLM logon errors on SBS 2003
    ... I get hundereds of event ID 537 during daytime in the security log of our ... does not show which workstation or service is causing the faild login. ... Any hints how to pinpoint the culprit workstation an service will be highly ... Während der Anmeldung ist ein Fehler aufgetreten. ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Event logs dont match
    ... I am not saying that the DC log is untrustworthy; ... The DC's log says that it was accessed remotely from his workstation from ... >> The primary domain controller security log says that Steve ... >> that time, but contains login info from that morning, and ...
    (microsoft.public.security)
Quantcast