Help with account auditing win2k

From: M. Simioni (m.simioniREMOVETHIS_at_TOCONTACTMEwooow.it)
Date: 04/26/05


Date: Tue, 26 Apr 2005 12:16:53 +0200

Hi, a few days ago i turned on the auditing on file&directory access from
ASPNET user account.

Since then i noticed many events in Protection Log about this failrue:
 "Object name: C:\WINNT\7WTMZC5Q7S9UBO1M"
 "Accesses: SYNCHRONIZE, ReadData (or ListDirectory)"
i get this message every day, and the object "7WTMZC5Q7S9UBO1M" seems to be
a random generated name that changes every time.

I also got events about this failrue:
"Object name: C:\Documents and Settings\Default User\Impostazioni
locali\Dati applicazioni\fusioncache.dat"
 "Accesses: READ_CONTROL,SYNCHRONIZE,ReadData (o ListDirectory),WriteData (o
AddFile),AppendData (o AddSubdirectory o
CreatePipeInstance) ,ReadEA,WriteEA,ReadAttributes,WriteAttributes "

what this attempts should be? any idea?
the ASPNET account already has Read Attribute on C:\WINT, so what's the
first event and how can i fix it?
it has Read Attribute on "C:\Documents and Settings\Default
User\Impostazioni locali\Dati applicazioni", should i grant Full Control to
him?

thnx i.a.
Marco