I've been seeing event ID 560s with the following details. Can anyone help
decipher them? They're on my DCs only. I can't find anything that explains
why I'm getting these as failures. Everything seems to be working well. :-)
Not sure where I go from here to isolate or troubleshoot the problem...
Thanks!
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 1/15/2004
Time: 3:00:46 PM
User: NT AUTHORITY\LOCAL SERVICE
Computer: EVLDC01
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: \Device\NetbiosSmb
Handle ID: -
Operation ID: {0,248820318}
Process ID: 1212
Image File Name: C:\WINDOWS\system32\svchost.exe
Primary User Name: LOCAL SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E5)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x100003
**********************
Charlie Kaiser
MCSE, CCNA
Systems Engineer
Essex Credit / Brickwalk
510 985 0975 x5083
**********************
List info : http://www.activedir.org/mail_list.htm
List FAQ : http://www.activedir.org/list_faq.htm
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
