Solved

Event Viewer: Event Viewer Failure Audits & System Information errors...

Posted on 2004-08-22
9
583 Views
Last Modified: 2008-03-17
XP Pro
Stand Alone PC
All Unused Services Diabled
All Updates
Firewall/Anti-Virus/Anti-Spyware

PC is working fine. No problems other than a large amount of the following  in Event Viewer: Fuilure Audits  Error 560 Object Access, Object Name is changes (desktop, winlogon to name a few) I get about 70/80 in 2 minutes at Logon.

Also, I can't access System Information.  I get the error message: "Can't  access Windows Management Software. Windows Management file may have been moved or missing.

I have gone Microsoft and I can't quite find a solution. I do have DCOM turned off, could that be it?                  
0
Comment
Question by:chick7t7
  • 4
  • 3
9 Comments
 
LVL 22

Expert Comment

by:cookre
Comment Utility
Error 560:
Indicates that an attempt was made to assign protection to a file system file or directory and one of the SIDs in the security descriptor could not be translated into a GUID that could be stored by the file system. This causes the protection attempt to fail, which may cause a file creation attempt to fail.  

>>>All Unused Services Disabled
How do you determine if a service is unused?

0
 

Author Comment

by:chick7t7
Comment Utility
If I do not use the service  or need the service or any of it's dependencies i consider it unused and disable it.  Now you got me worried. Could that be my problem? Here is my list of what I disable.
Thanks a buinch!!
Alerter
Clipbook
Faster Using Switching
Human Interface Device
Indexing
Net Logon
Messenger
Net Meeting Remote DeskTop Sharing
Network DDE
Network DDe DSDM
Performance Logs
Portable Media
Remore Desktop Help
Remore Registry
QO RSVP
Routing and Remote Access
Secondary Log On
Smart Card
Smart Card Helper
SSDP Discovery
TCP?IP Net Bios Helper
Telnet
Terminal Server
Uninterruptiblel Power Supply
Universal Pllug and Play Device
Upload Manager
Webclient
Wireless Zero Configuration
Workstation.



0
 
LVL 22

Expert Comment

by:cookre
Comment Utility
Some services and programs start other services at run time.  If the service to be started has been disabled, it won't start.

Look in the System event log for type 7000 entries.
Those show services that couldn't be started because they had been disabled.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 

Author Comment

by:chick7t7
Comment Utility
Thank you.
My problem is not with start up. I mean I am able to access everthing with no problems that I can tell...so far anyway.
 But, I do have thousands of "Failure Audits: Object Access  Error 560.

The object type: Desktop, Winlogon, Event, Window Station, Mutant.

I have gone to Microsoft via help on my PC, it sayd "No User action Required?
But,  I think 2800 error messages constitutes needing help ;)

Any other ideas! :)

0
 
LVL 22

Expert Comment

by:cookre
Comment Utility
>>>My problem is not with start up.
Services can be started at anytime by anyone.

Since you're stand-alone with no connection, disable the firewall and see if those messages go away.

0
 

Author Comment

by:chick7t7
Comment Utility
Ok, But what do you mean "no connection"? Sorry ...still a newbie. if you mean connecion to the internet, I have a connection no problem. :)
0
 
LVL 22

Accepted Solution

by:
cookre earned 500 total points
Comment Utility
In that case, you've disabled a number of connection related services, for example, Workstation has 5 other services dependent on it, and SecondaryLogon disabled means that no process can call CreateProcessAs().

Now, if you're otherwise happy with the box, you don't mind the errors reports, and clear the logs every now and then to save space, you can just leave things as they are.  Otherwise, I'd re-enable them all.

The ones with start up type 'manual' don't grt started automatically, rather, just when someone needs them.

If your concern is security, well, that's what configuration parameters are for.
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

I know it’s not a new topic to discuss and it has lots of online contents already available over the net. But Then I thought it would be useful to this site’s visitors and can have online repository on vim most commonly used commands. This post h…
Since upgrading to Office 2013 or higher installing the Smart Indenter addin will fail. This article will explain how to install it so it will work regardless of the Office version installed.
In this fourth video of the Xpdf series, we discuss and demonstrate the PDFinfo utility, which retrieves the contents of a PDF's Info Dictionary, as well as some other information, including the page count. We show how to isolate the page count in a…
In this fifth video of the Xpdf series, we discuss and demonstrate the PDFdetach utility, which is able to list and, more importantly, extract attachments that are embedded in PDF files. It does this via a command line interface, making it suitable …

728 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now