[windows2000] Re: Security Event ID 560
- From: Jesse Kitson <jesse.kitson@xxxxxxxxx>
- To: windows2000@xxxxxxxxxxxxx
- Date: Thu, 4 Aug 2005 10:26:41 -0400
Bob,
We have our logs set to 2meg and over write as necessary. This will
work fine (unless you are trying to catch someone doing something
wrong). You could also find out why the user is trying to access a
file that he doesn't have access to (could be he should have access
for program to run correctly).
On 8/3/05, Schneider, Robert <Robert.Schneider@xxxxxxxx> wrote:
>
>
> Phillip,
> I went to this site prior to sending message to freelist. The GPO
> configuration, Audit the access of global system objects policy, click
> Disabled under Local Policy,
>
> Did not fix the problem, 560s keep writing. Any other ideas? It seems if you
> enable Audit Object Access, the 560s (Audit Failures) are written to the
> Security Event logs. Microsoft claims 'no user action required', yet on this
> system the logs fill up in short time! This is a problem, and I would like
> to know why so many are written.
>
> Thanks in advance,
> Bob
>
> Bob Schneider
> L3 Communications/ILEX Systems
> IAVA Support
> 732-530-8444 x3503
> mailto:robert.schneider@xxxxxxxx
>
>
> -----Original Message-----
> From: windows2000-bounce@xxxxxxxxxxxxx
> [mailto:windows2000-bounce@xxxxxxxxxxxxx]On Behalf Of
> Phillip Newberry
> Sent: Wednesday, August 03, 2005 1:40 AM
> To: windows2000@xxxxxxxxxxxxx
> Subject: [windows2000] Re: Security Event ID 560
>
> Robert
>
> Looks like the follwoing may help you
>
> http://support.microsoft.com/Default.aspx?id=841001
>
>
> --- "Schneider, Robert" <Robert.Schneider@xxxxxxxx>
> wrote:
>
> > All,
> > A system has the Security Event logs filling up
> > with Event ID 560s! 100s
> > are written with the same time stamp. The user
> > involved has restricted
> > privileges. Has anyone had this problem that can
> > help resolve this issue.
> > What Is the Accesses list telling us? Could this be
> > an Audit configuration
> > in GPO?
> > The screenshot is a sample.
> >
> >
> > Thanks
> > Bob
> >
> > Bob Schneider
> > L3 Communications/ILEX Systems
> > IAVA Support
> > 732-530-8444 x3503
> > mailto:robert.schneider@xxxxxxxx
> > <mailto:robert.schneider@xxxxxxxx>
> >
> >
>
>
> Phil Newberry
> Computer Network Engineer Consultant
> MCSE NT&2000, MCP+IIS CNA, CAN
>
> Your destiny is in your hands. Just do it.
>
> __________________________________________________
> Do You Yahoo!?
> Tired of spam? Yahoo! Mail has the best spam protection around
> http://mail.yahoo.com
> ********************************************************
> This Weeks Sponsor: Straymonkey.com
> Excellent web templates, fonts, and downloads
> on this new site brought to you by The Kenzig Group
> http://www.straymonkey.com
> **********************************************************
> To Unsubscribe, set digest or vacation
> mode or view archives use the below link.
>
> http://thethin.net/win2000list.cfm
--
Jesse E. Kitson
From gmail.com
********************************************************
This Weeks Sponsor: Straymonkey.com
Excellent web templates, fonts, and downloads
on this new site brought to you by The Kenzig Group
http://www.straymonkey.com
**********************************************************
To Unsubscribe, set digest or vacation
mode or view archives use the below link.
http://thethin.net/win2000list.cfm
Other related posts:
