Solved

Object Access - Security Event Log Failure Audit 560

Posted on 2008-11-01
1
3,650 Views
Last Modified: 2013-12-04
I am runnning Windows Server 2003 with SP 2 and am still getiing multiple instances of this failure audit. I would like to turn off auditing object access but it has be turned on for compliance reasons.
It is always the same object \Device\NetbiosSmb at C:\WINDOWS\system32\svchost.exe that is filling my security log file (two events every minute)

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Object Access
Event ID:      560
Date:            11/1/2008
Time:            10:44:54 AM
User:            NT AUTHORITY\LOCAL SERVICE
Computer:      123
Description:
Object Open:
       Object Server:      Security
       Object Type:      File
       Object Name:      \Device\NetbiosSmb
       Handle ID:      -
       Operation ID:      {0,540101}
       Process ID:      860
       Image File Name:      C:\WINDOWS\system32\svchost.exe
       Primary User Name:      LOCAL SERVICE
       Primary Domain:      NT AUTHORITY
       Primary Logon ID:      (0x0,0x3E5)
       Client User Name:      -
       Client Domain:      -
       Client Logon ID:      -
       Accesses:      SYNCHRONIZE
                  ReadData (or ListDirectory)
                  WriteData (or AddFile)
                  
       Privileges:      -
       Restricted Sid Count:      0
       Access Mask:      0x100003

0
Comment
Question by:eric789
1 Comment
 
LVL 8

Accepted Solution

by:
smilerz earned 500 total points
Comment Utility
According to <a href="http://www.itnewsgroups.net/group/microsoft.public.windows.server.general/topic8837.aspx">this </a>site, this is expected behavior. " This error appear every 2 minutes on machines where domain users tries to query the status of the indexing service, where this clients have not permission, so it generates a failure audit if audit object access is turned on. You can just turn off auditing of object access or, you can turn off auditing on that specific service. In Group policy, go to Computer Configuration -> Windows Settings -> Security Settings -> System Services. Double click the indexing service, set it to disabled, and then click Edit Security. At this point there are two options, you can give the users who this is happening to permission to the service, or you can go into auditing and remove auditing for everyone for failed events (which is on by default on all services)." You can turn off failure just for that object if you want to eliminate that error - otherwise I think you are stuck.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

A quick step-by-step overview of installing and configuring Carbonite Server Backup.
Our Group Policy work started with Small Business Server in 2000. Microsoft gave us an excellent OU and GPO model in subsequent SBS editions that utilized WMI filters, OU linking, and VBS scripts. These are some of experiences plus our spending a lo…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now