[THIN] Re: handle closed event log
- From: "jc lamb" <jc_lamb@xxxxxxxxxxx>
- To: <thin@xxxxxxxxxxxxx>
- Date: Mon, 1 Mar 2004 07:41:33 -0800
Thanks Henry
we are grabbing at straws here as to why this client is disconnecting. they
wont give us network traces or firewall logs or anything else (so far).
I appreciate the information!
Jeff
----- Original Message -----
From: "Henry Sieff" <hsieff@xxxxxxxxxxxx>
To: <thin@xxxxxxxxxxxxx>
Sent: Sunday, February 29, 2004 12:21 PM
Subject: [THIN] Re: handle closed event log
> THis is a pretty standard one. You have auditing of objects turned on, and
> the security logger is reporting all successful connections (and
> disconnections) to/from the SAM. When you log on, you access the SAM (to
> authenticate); when acessing, you are given a 'handle' (pretty much like
any
> network file access) which is used by the login process to refer to the
SAM.
> When you log off (or maybe even after a disconnect; not sure, would need
to
> experiment) the handle is closed since you no longer need it (the handle
is
> used throughout a session for further calls to the SAM when required.)
>
> In a disconnect, the handle close will probably occur after a period of
> time, again like a file handle.
>
> Not sure if this event will be useful; like I said, this will happen
> whenever a user logs off or whenever the handle just times out.
>
> HTH.
>
> Henry
>
> > -----Original Message-----
> > From: jc lamb [mailto:jc_lamb@xxxxxxxxxxx]
> > Sent: Friday, February 27, 2004 1:39 PM
> > To: thin@xxxxxxxxxxxxx
> > Subject: [THIN] handle closed event log
> >
> >
> > hey kids
> > I cant find any reference to the following security event log entry
> > can any of you help?
> >
> > Event Type: Success Audit
> > Event Source: Security
> > Event Category: Object Access
> > Event ID: 562
> > Date: 2/27/2004
> > Time: 10:09:03 AM
> > User: username
> > Computer: servername
> > Description:
> > Handle Closed:
> > Object Server: Security Account Manager
> > Handle ID: 1055936
> > Process ID: 424
> >
> > the shortly after we have a successful logoff - but the user
> > is experiencing a dropped connection.
> >
> > thanks
> > Jeff
> >
> > ********************************************************
> > This weeks sponsor triCerat Inc.
> > triCerat makes your job easier by offering essential
> > applications to eliminate your printing, policy and profile,
> > and your application management problems.
> > http://www.triCerat.com
> > **********************************************************
> > Useful Thin Client Computing Links are available at:
> > http://thin.net/links.cfm
> > ***********************************************************
> > For Archives, to Unsubscribe, Subscribe or
> > set Digest or Vacation mode use the below link:
> > http://thin.net/citrixlist.cfm
> >
> ********************************************************
> This weeks sponsor triCerat Inc.
> triCerat makes your job easier by offering essential
> applications to eliminate your printing, policy and profile,
> and your application management problems.
> http://www.triCerat.com
> **********************************************************
> Useful Thin Client Computing Links are available at:
> http://thin.net/links.cfm
> ***********************************************************
> For Archives, to Unsubscribe, Subscribe or
> set Digest or Vacation mode use the below link:
> http://thin.net/citrixlist.cfm
>
********************************************************
This weeks sponsor triCerat Inc.
triCerat makes your job easier by offering essential
applications to eliminate your printing, policy and profile,
and your application management problems.
http://www.triCerat.com
**********************************************************
Useful Thin Client Computing Links are available at:
http://thin.net/links.cfm
***********************************************************
For Archives, to Unsubscribe, Subscribe or
set Digest or Vacation mode use the below link:
http://thin.net/citrixlist.cfm
Other related posts:
