• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3780
  • Last Modified:

Object Access - Security Event Log Failure Audit 560

I am runnning Windows Server 2003 with SP 2 and am still getiing multiple instances of this failure audit. I would like to turn off auditing object access but it has be turned on for compliance reasons.
It is always the same object \Device\NetbiosSmb at C:\WINDOWS\system32\svchost.exe that is filling my security log file (two events every minute)

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Object Access
Event ID:      560
Date:            11/1/2008
Time:            10:44:54 AM
User:            NT AUTHORITY\LOCAL SERVICE
Computer:      123
Description:
Object Open:
       Object Server:      Security
       Object Type:      File
       Object Name:      \Device\NetbiosSmb
       Handle ID:      -
       Operation ID:      {0,540101}
       Process ID:      860
       Image File Name:      C:\WINDOWS\system32\svchost.exe
       Primary User Name:      LOCAL SERVICE
       Primary Domain:      NT AUTHORITY
       Primary Logon ID:      (0x0,0x3E5)
       Client User Name:      -
       Client Domain:      -
       Client Logon ID:      -
       Accesses:      SYNCHRONIZE
                  ReadData (or ListDirectory)
                  WriteData (or AddFile)
                  
       Privileges:      -
       Restricted Sid Count:      0
       Access Mask:      0x100003

0
eric789
Asked:
eric789
1 Solution
 
smilerzCommented:
According to <a href="http://www.itnewsgroups.net/group/microsoft.public.windows.server.general/topic8837.aspx">this </a>site, this is expected behavior. " This error appear every 2 minutes on machines where domain users tries to query the status of the indexing service, where this clients have not permission, so it generates a failure audit if audit object access is turned on. You can just turn off auditing of object access or, you can turn off auditing on that specific service. In Group policy, go to Computer Configuration -> Windows Settings -> Security Settings -> System Services. Double click the indexing service, set it to disabled, and then click Edit Security. At this point there are two options, you can give the users who this is happening to permission to the service, or you can go into auditing and remove auditing for everyone for failed events (which is on by default on all services)." You can turn off failure just for that object if you want to eliminate that error - otherwise I think you are stuck.
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now