Handle to PlugPlaySecurityObject - Millions of events.

We are getting this message literally millions of times each day on our Windows 2008, SQL 2005 Server.

 Event ID: 4656
Log Type: Security
Event Type: Audit Success
Category: 0
Source: Microsoft-Windows-Security-Auditing
Domain: ADMIN
Computer: SQLPROD8A
User: N/A
 A handle to an object was requested.

Security ID: S-1-5-18
Account Name: SQLPROD8A$
Account Domain: ADMIN
Logon ID: 0x3e7

Object Server: PlugPlayManager
Object Type: Security
Object Name: PlugPlaySecurityObject
Handle ID: 0x0

Process Information:
Process ID: 0x318
Process Name: C:\Windows\System32\svchost.exe

Access Request Information:
Transaction ID: {00000000-0000-0000-0000-000000000000}
Accesses: Unknown specific access (bit 1)

Access Mask: 0x2
Privileges Used for Access Check: -
Restricted SID Count: 0

Any ideas?  It's really pounding our event tracking software.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

kmccubbinAuthor Commented:
Thatnks for the response.  I know that Object Auditing is the source of the alerts and I was about to say, "But why is it only happened on one of our many SQL servers and not the others?"  However, on investigating, I learned that it is happening on all of my Windows 2008 SQL servers and none of my 2003 or 2000 servers.  Any idea why?  And why "Plug and Play?"
Some of these events can be very aggressive on the Security log after object auditing is enabled. For example, the "PlugPlayManager" is going under "Other Object Access Events". You can disable this category events by doing the following:

Start the Command Prompt:
Type: auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:enable

This will disable all the Success message in the category "Other Object Access Events" but allowing failed attempts to be logged.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.