Sorry for bit late response. I would even try to figure out the meaning of the
event. Obviously you have REG KEY
HKLM\SYSTEM\CurrentControlSet\Control\LSA\AuditBaseObjects (REG_DWORD) set to 1
if this is the case set the key to 0. Auditing base objects are of use to no one
other than developers.
Jasmin
|--------+-------------------------->
| | "Fallon, |
| | Benjamin" |
| | <bfallon@Busines|
| | sedge.com> |
| | |
| | 24/04/2002 02:14|
| | AM |
| | |
|--------+-------------------------->
>----------------------------------------------------------------------------|
| |
| To: "'Calhoun, Heath'" <[EMAIL PROTECTED]>, |
| [EMAIL PROTECTED] |
| cc: (bcc: Jas Amidzic/Staff/ABS) |
| Subject: RE: Windows Event 560 |
>----------------------------------------------------------------------------|
While a bit cryptic, here is the link to the TechNet Windows 2000 Security
Event Descriptions (Part 1 of 2) (Q299475)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q299475
Hope this helps a little.
Ben
-----Original Message-----
From: Calhoun, Heath [mailto:[EMAIL PROTECTED]]
Sent: Monday, April 22, 2002 3:49 PM
To: [EMAIL PROTECTED]
Subject: Windows Event 560
Hello. We are trying to figure out with no success the meaning of a Windows
2000 error when running
the security audit.
We are running sp2 with the latest hotfixes. The error is event 560:
Security Event Log object access
\baseNamedObjects\RasPbFile
on reboot, it writes multiple entries.
Thanks.
Heath Calhoun
-----------------------------------------------
ABS Web Site: www.abs.gov.au
