[THIN] Re: handle closed event log

THis is a pretty standard one. You have auditing of objects turned on, and
the security logger is reporting all successful connections (and
disconnections) to/from the SAM. When you log on, you access the SAM (to
authenticate); when acessing, you are given a 'handle' (pretty much like any
network file access) which is used by the login process to refer to the SAM.
When you log off (or maybe even after a disconnect; not sure, would need to
experiment) the handle is closed since you no longer need it (the handle is
used throughout a session for further calls to the SAM when required.)

In a disconnect, the handle close will probably occur after a period of
time, again like a file handle.

Not sure if this event will be useful; like I said, this will happen
whenever a user logs off or whenever the handle just times out.

HTH.

Henry

> -----Original Message-----
> From: jc lamb [mailto:jc_lamb@xxxxxxxxxxx]
> Sent: Friday, February 27, 2004 1:39 PM
> To: thin@xxxxxxxxxxxxx
> Subject: [THIN] handle closed event log
> 
> 
> hey kids
> I cant find any reference to the following security event log entry
> can any of you help?
> 
> Event Type: Success Audit
> Event Source: Security
> Event Category: Object Access 
> Event ID: 562
> Date:  2/27/2004
> Time:  10:09:03 AM
> User:  username
> Computer: servername
> Description:
> Handle Closed:
>   Object Server: Security Account Manager
>   Handle ID: 1055936
>   Process ID: 424
>  
> the shortly after we have a successful logoff - but the user 
> is experiencing a dropped connection.
> 
> thanks
> Jeff
> 
> ********************************************************
> This weeks sponsor triCerat Inc.
> triCerat makes your job easier by offering essential
> applications to eliminate your printing, policy and profile,
> and your application management problems.
> http://www.triCerat.com 
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or 
> set Digest or Vacation mode use the below link:
> http://thin.net/citrixlist.cfm
> 
********************************************************
This weeks sponsor triCerat Inc.
triCerat makes your job easier by offering essential
applications to eliminate your printing, policy and profile,
and your application management problems.
http://www.triCerat.com 
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or 
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm

Other related posts: