Re: Permissions on SYSVOL Directory
From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 11/14/05
- Next message: Steven L Umbach: "Re: Any Way To Get Machine Name for Client in Event ID 560?"
- Previous message: Will: "Collecting Security Logs to Central Server?"
- In reply to: Will: "Permissions on SYSVOL Directory"
- Next in thread: Will: "Re: Permissions on SYSVOL Directory"
- Reply: Will: "Re: Permissions on SYSVOL Directory"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Sun, 13 Nov 2005 22:34:04 -0600
I have never actually tried to audit that directory but are those client
computers failing to have Group Policy applied to them which among other
things would be evidenced by errors/warnings for userenv in the application
log and errors when running gpresult?? You also might want to enable debug
logging of userenv to see what is going on with GP processing by looking at
the userenv.log file. --- Steve
"Will" <DELETE_westes@earthbroadcast.com> wrote in message
news:d_-dnXBdtegfaereRVn-hQ@giganews.com...
> I'm getting an EventID 560 from machines on our network trying to access
> SYSVOL, and in examining the detail of the message I'm confused by what is
> happening. On our domain controller, the sysvol *share* is located at
> %SYSTEMROOT%\sysvol\sysvol. I've never understood why there is a sysvol
> share under the directory named sysvol. Maybe someone can explain that
> one
> to me as well.
>
> What I am seeing in the security section of eventviewer is that machines
> are
> trying to apply group policy by directory accessing the
> %SYSTEMROOT%\sysvol
> directory and NOT using the sysvol share. A typical event 560 error is
> as
> follows:
>
> Object Open:
> Object Server: Security
> Object Type: File
> Object Name:
> \Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolume2\WINNT\SYSVOL\DOMAIN
> \POLICIES\{61A2F...}\MACHINE\MICROSOFT\WINDOWS NT\SECEDIT\GPTTMPL.INF
> New Handle ID: -
> Operation ID: {0,67842636}
> Process ID: 8
> Primary User Name: DOMAIN-CONTROLLERA$
> Primary Domain: CORPORATE
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: CLIENT-WORKSTATIONC$
> Client Domain: CORPORATE
> Client Logon ID: (0x0,0x55B231A)
> Accesses READ_CONTROL
> ReadData (or ListDirectory)
> ReadEA
> ReadAttributes
>
> Privileges -
>
>
> I'm confused by a number of things here:
>
> 1) Why are machines attempting to apply group policy through a location
> that
> does not travel through the SYSVOL share?
>
> 2) Even once I explicitly give Read and Read & Execute permission to all
> Domain Users and Domain Computers to access the specific path they are
> traversing, I still get the event id 560.
>
> Any help understanding this is appreciated.
>
> --
> Will
>
>
- Next message: Steven L Umbach: "Re: Any Way To Get Machine Name for Client in Event ID 560?"
- Previous message: Will: "Collecting Security Logs to Central Server?"
- In reply to: Will: "Permissions on SYSVOL Directory"
- Next in thread: Will: "Re: Permissions on SYSVOL Directory"
- Reply: Will: "Re: Permissions on SYSVOL Directory"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
