Handle to PlugPlaySecurityObject - Millions of events.

kmccubbin used Ask the Experts™
We are getting this message literally millions of times each day on our Windows 2008, SQL 2005 Server.

 Event ID: 4656
Log Type: Security
Event Type: Audit Success
Category: 0
Source: Microsoft-Windows-Security-Auditing
Domain: ADMIN
Computer: SQLPROD8A
User: N/A
 A handle to an object was requested.

Security ID: S-1-5-18
Account Name: SQLPROD8A$
Account Domain: ADMIN
Logon ID: 0x3e7

Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0

Process Information:
Process ID: 0x318
Process Name: C:\Windows\System32\svchost.exe

Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)

Access Mask: 0x2
Privileges Used for Access Check: -
Restricted SID Count: 0

Any ideas?  It's really pounding our event tracking software.
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®


Thatnks for the response.  I know that Object Auditing is the source of the alerts and I was about to say, "But why is it only happened on one of our many SQL servers and not the others?"  However, on investigating, I learned that it is happening on all of my Windows 2008 SQL servers and none of my 2003 or 2000 servers.  Any idea why?  And why "Plug and Play?"
Some of these events can be very aggressive on the Security log after object auditing is enabled. For example, the "PlugPlayManager" is going under "Other Object Access Events". You can disable this category events by doing the following:

Start the Command Prompt:
Type: auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:enable

This will disable all the Success message in the category "Other Object Access Events" but allowing failed attempts to be logged.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial