Re: Event ID 560 (SC_MANAGER OBJECT)

Great. Thanks for reporting back.

Steve

"Johnny" <Johnny@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F366FC2A-CD22-4FCE-858C-A5048E5CA469@xxxxxxxxxxxxxxxx
I found the hotfix for it, Q910720.

"Steven L Umbach" wrote:

Object access events can be somewhat obscure and I would not worry about
it
if everything is working well. Unless you have a specific need to audit
object access such as to audit access to folders you may want to disable
it
in Local Security Policy or the domain level policy that enforces it. By
default it is not enabled on XP.

Steve


"Johnny" <Johnny@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:DEF5BCE2-E351-4651-9D7A-22A5944546C9@xxxxxxxxxxxxxxxx
I am getting this error message everytime the system boots up. How do I
fix
this problem?

Source: Security
Event ID: 560
Category: Object Access
User: NT AUTHORITY\NETWORK SERVICE

Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,50957}
Process ID: 828
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: C9060931$
Primary Domain: RSP
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: READ_CONTROL
Connect to service controller
Lock service database for exclusive access

Privileges: -
Restricted Sid Count: 0





.

Relevant Pages

  • Re: Audit Failures/READ_CONTROL SYNCHRONIZE
    ... The 560 object access event does not record what actions were performed on ... it records what accesses were requested to the file. ... > Primary Logon ID: ... > Client User Name: - ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: WMI / DCOM ACCESS DENIED
    ... I finally started logging Object Access and looks like Network Service ... Primary Logon ID: ... Client User Name: NETWORK SERVICE ... Query information from service ...
    (microsoft.public.security)
  • Re: Auditing file deletion
    ... The problem is that hundreds of other Object Access events get logged, ... just the file and directory deletions. ... Default Domain Controllers Policy. ... double-click Audit Policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)
  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)
Quantcast