[THIN] Re: handle closed event log
- From: Henry Sieff <hsieff@xxxxxxxxxxxx>
- To: "'thin@xxxxxxxxxxxxx'" <thin@xxxxxxxxxxxxx>
- Date: Sun, 29 Feb 2004 14:21:19 -0600
THis is a pretty standard one. You have auditing of objects turned on, and
the security logger is reporting all successful connections (and
disconnections) to/from the SAM. When you log on, you access the SAM (to
authenticate); when acessing, you are given a 'handle' (pretty much like any
network file access) which is used by the login process to refer to the SAM.
When you log off (or maybe even after a disconnect; not sure, would need to
experiment) the handle is closed since you no longer need it (the handle is
used throughout a session for further calls to the SAM when required.)
In a disconnect, the handle close will probably occur after a period of
time, again like a file handle.
Not sure if this event will be useful; like I said, this will happen
whenever a user logs off or whenever the handle just times out.
HTH.
Henry
> -----Original Message-----
> From: jc lamb [mailto:jc_lamb@xxxxxxxxxxx]
> Sent: Friday, February 27, 2004 1:39 PM
> To: thin@xxxxxxxxxxxxx
> Subject: [THIN] handle closed event log
>
>
> hey kids
> I cant find any reference to the following security event log entry
> can any of you help?
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Object Access
> Event ID: 562
> Date: 2/27/2004
> Time: 10:09:03 AM
> User: username
> Computer: servername
> Description:
> Handle Closed:
> Object Server: Security Account Manager
> Handle ID: 1055936
> Process ID: 424
>
> the shortly after we have a successful logoff - but the user
> is experiencing a dropped connection.
>
> thanks
> Jeff
>
> ********************************************************
> This weeks sponsor triCerat Inc.
> triCerat makes your job easier by offering essential
> applications to eliminate your printing, policy and profile,
> and your application management problems.
> http://www.triCerat.com
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or
> set Digest or Vacation mode use the below link:
> http://thin.net/citrixlist.cfm
>
********************************************************
This weeks sponsor triCerat Inc.
triCerat makes your job easier by offering essential
applications to eliminate your printing, policy and profile,
and your application management problems.
http://www.triCerat.com
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm
Other related posts:
