?
Solved

Take ownership attempts based on object access events

Posted on 2010-03-26
2
Medium Priority
?
932 Views
Last Modified: 2012-05-09
I am getting tons of these:

A handle to an object was requested.

Subject:

      Security ID:            S-1-5-18

      Account Name:            DC01$ (domain controler name)

      Account Domain:            XXXXX (domain name)

      Logon ID:            

Object:

      Object Server:            Security

      Object Type:            Key

      Object Name:            \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SamSs

      Handle ID:            1260

Process Information:

      Process ID:            2696

      Process Name:            C:\Windows\System32\CpqMgmt\cqmghost\cqmghost.exe

Access Request Information:

      Transaction ID:            00000000-0000-0000-0000-000000000000

      Accesses:            DELETE

                  READ_CONTROL

                  WRITE_DAC

                  WRITE_OWNER

                  Query key value

                  Set key value

                  Create sub-key

                  Enumerate sub-keys

                  Notify about changes to keys

                  Create Link

                  

      Access Mask:            

      Privileges Used for Access Check:      -

      Restricted SID Count:      0



0
Comment
Question by:nourben
1 Comment
 
LVL 16

Accepted Solution

by:
Ady Foot earned 2000 total points
ID: 28863359
Hi there,

This is nothing to worry about - it is simply saying that permissions were checked.  You obviously have this level of detailed auditing enabled through Group Policy.  For more information about the particular event please see http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4656 or http://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4661 (you don't give me the exact event ID).

Regards,

Ady
0

Featured Post

Receive 1:1 tech help

Solve your biggest tech problems alongside global tech experts with 1:1 help.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This is a little timesaver I have been using for setting up Microsoft Small Business Server (SBS) in the simplest possible way. It may not be appropriate for every customer. However, when you get a situation where the person who owns the server is i…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…

589 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question