I currently have almost the same problem with one of my webservers.
Event ID: 560
Object Open:
Object Server: Security
Object Type: Event
Object Name: \BaseNamedObjects\MSDTC_NAMED_EVENT
New Handle ID: -
Operation ID: {0,27056267}
Process ID: 3496
Primary User Name: WEBDOMAIN
Primary Domain: mywebserver
Primary Logon ID: (0x0,0x152808C)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER
SYNCHRONIZE
Query event state
Modify event state
Privileges -
The server is currently generating 2 errors per second.
Could anyone help with this...?
Thank you,
Dieter Scholtyssek
[EMAIL PROTECTED]
"Jas Amidzic" To: "Fallon, Benjamin"
<[EMAIL PROTECTED]>
<jasmin.amidzic@a cc: "'Calhoun, Heath'"
<[EMAIL PROTECTED]>,
bs.gov.au> [EMAIL PROTECTED], (bcc:
Dieter
Scholtyssek/CONTRACTOR/7BC/R07/GSA/GOV)
05/02/2002 06:23 Subject: RE: Windows Event 560
PM
Sorry for bit late response. I would even try to figure out the meaning of
the
event. Obviously you have REG KEY
HKLM\SYSTEM\CurrentControlSet\Control\LSA\AuditBaseObjects (REG_DWORD) set
to 1
if this is the case set the key to 0. Auditing base objects are of use to
no one
other than developers.
Jasmin
|--------+-------------------------->
| | "Fallon, |
| | Benjamin" |
| | <bfallon@Busines|
| | sedge.com> |
| | |
| | 24/04/2002 02:14|
| | AM |
| | |
|--------+-------------------------->
>
----------------------------------------------------------------------------|
|
|
| To: "'Calhoun, Heath'" <[EMAIL PROTECTED]>,
|
| [EMAIL PROTECTED]
|
| cc: (bcc: Jas Amidzic/Staff/ABS)
|
| Subject: RE: Windows Event 560
|
>
----------------------------------------------------------------------------|
While a bit cryptic, here is the link to the TechNet Windows 2000 Security
Event Descriptions (Part 1 of 2) (Q299475)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q299475
Hope this helps a little.
Ben
-----Original Message-----
From: Calhoun, Heath [mailto:[EMAIL PROTECTED]]
Sent: Monday, April 22, 2002 3:49 PM
To: [EMAIL PROTECTED]
Subject: Windows Event 560
Hello. We are trying to figure out with no success the meaning of a
Windows
2000 error when running
the security audit.
We are running sp2 with the latest hotfixes. The error is event 560:
Security Event Log object access
\baseNamedObjects\RasPbFile
on reboot, it writes multiple entries.
Thanks.
Heath Calhoun
-----------------------------------------------
ABS Web Site: www.abs.gov.au
