RestlessSpirit
asked on
EventID 560
I am having issues with accessing HP System Management Homepage. I can get in but everything isn't there. I have pinpointed something in the event log that appears everytime I try to log into it and it is EventID 560 that appears 8 times after every attempt. I am not sure how to correct this issue or what this Event exactly means. I have Domain Admin rights and have tried both locally and MS Terminal Services. Nothing seems to help. Any ideas?
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 6/30/2009
Time: 7:02:42 AM
User: NT AUTHORITY\SYSTEM
Computer: ARMCMDAW11
Description:
Object Open:
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\MACHINE\SOFTWARE \Microsoft \Windows NT\CurrentVersion\Perflib
Handle ID: -
Operation ID: {0,16368409}
Process ID: 4860
Image File Name: C:\WINDOWS\system32\wbem\w miprvse.ex e
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: ARMCMDAW11$
Client Domain: ARMCMD
Client Logon ID: (0x0,0x3E7)
Accesses: ACCESS_SYS_SEC
MAX_ALLOWED
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x3000000
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 6/30/2009
Time: 7:02:42 AM
User: NT AUTHORITY\SYSTEM
Computer: ARMCMDAW11
Description:
Object Open:
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\MACHINE\SOFTWARE
Handle ID: -
Operation ID: {0,16368409}
Process ID: 4860
Image File Name: C:\WINDOWS\system32\wbem\w
Primary User Name: NETWORK SERVICE
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E4)
Client User Name: ARMCMDAW11$
Client Domain: ARMCMD
Client Logon ID: (0x0,0x3E7)
Accesses: ACCESS_SYS_SEC
MAX_ALLOWED
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x3000000
For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Is this running via IIS?
ASKER
IIS is running on the machine. I don't see SNMP listed anywhere in it though.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.