maderosia
asked on
repeating Failure Audit error in event log
I keep getting this in my security log on Small Business Server 2003 and I am not finding anything outthere to tell me what it is. Has anyone seen this one or tell me what to look for? I happens throughout the day and night and many times twice with in the same minute but not always.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/16/2006
Time: 11:00:18 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: HOCSBS
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: WinHttpAutoProxySvc
Handle ID: -
Operation ID: {0,464755939}
Process ID: 668
Image File Name: C:\WINDOWS\system32\servic es.exe
Primary User Name: HOCSBS$
Primary Domain: HOC
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: Query status of service
Start the service
Query information from service
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x94
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Thanks,
Mark
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/16/2006
Time: 11:00:18 PM
User: NT AUTHORITY\NETWORK SERVICE
Computer: HOCSBS
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: WinHttpAutoProxySvc
Handle ID: -
Operation ID: {0,464755939}
Process ID: 668
Image File Name: C:\WINDOWS\system32\servic
Primary User Name: HOCSBS$
Primary Domain: HOC
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: Query status of service
Start the service
Query information from service
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x94
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Thanks,
Mark
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks,
Mark