Help with account auditing win2k
From: M. Simioni (m.simioniREMOVETHIS_at_TOCONTACTMEwooow.it)
Date: 04/26/05
- Next message: Backup: "Re: HELP OWA BROKEN"
- Previous message: David Beder [MSFT]: "Re: XP sp2 turning off the firewall in group policies"
- Next in thread: Roger Abell: "Re: Help with account auditing win2k"
- Reply: Roger Abell: "Re: Help with account auditing win2k"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 26 Apr 2005 12:16:53 +0200
Hi, a few days ago i turned on the auditing on file&directory access from
ASPNET user account.
Since then i noticed many events in Protection Log about this failrue:
"Object name: C:\WINNT\7WTMZC5Q7S9UBO1M"
"Accesses: SYNCHRONIZE, ReadData (or ListDirectory)"
i get this message every day, and the object "7WTMZC5Q7S9UBO1M" seems to be
a random generated name that changes every time.
I also got events about this failrue:
"Object name: C:\Documents and Settings\Default User\Impostazioni
locali\Dati applicazioni\fusioncache.dat"
"Accesses: READ_CONTROL,SYNCHRONIZE,ReadData (o ListDirectory),WriteData (o
AddFile),AppendData (o AddSubdirectory o
CreatePipeInstance) ,ReadEA,WriteEA,ReadAttributes,WriteAttributes "
what this attempts should be? any idea?
the ASPNET account already has Read Attribute on C:\WINT, so what's the
first event and how can i fix it?
it has Read Attribute on "C:\Documents and Settings\Default
User\Impostazioni locali\Dati applicazioni", should i grant Full Control to
him?
thnx i.a.
Marco
- Next message: Backup: "Re: HELP OWA BROKEN"
- Previous message: David Beder [MSFT]: "Re: XP sp2 turning off the firewall in group policies"
- Next in thread: Roger Abell: "Re: Help with account auditing win2k"
- Reply: Roger Abell: "Re: Help with account auditing win2k"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]