Microsoft KB Archive/908473

= FIX: A Failure Audit event with event ID 560 appears in the Security log when you enable object auditing in Windows XP or in Windows Server 2003 =

Article ID: 908473

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition
 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Datacenter x64 Edition
 * Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
 * Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
 * Microsoft Windows XP Home Edition
 * Microsoft Windows XP Professional
 * Microsoft Windows XP Professional x64 Edition
 * Microsoft Windows XP Professional 64-Bit Edition (Itanium)

-





SYMPTOMS
When you enable object auditing in Microsoft Windows XP or in Microsoft Windows Server 2003, a Failure Audit event with event ID 560 appears in the Security log. The event entry will appear similar to the following:

Event Type: Failure Audit

Event Source: Security

Event Category: Object Access

Event ID: 560

Date:

Time:

User: NT AUTHORITY\SYSTEM

Computer: 

Description:

Object Open:

Object Server: SC Manager

Object Type: 

Object Name: 

Handle ID: -

Operation ID: {0,42016}

Process ID: 616

Image File Name: C:\WINDOWS\system32\services.exe

Primary User Name:

Primary Domain:

Primary Logon ID: (0x0,0x3E7)

Client User Name: NETWORK SERVICE

Client Domain: NT AUTHORITY

Client Logon ID: (0x0,0x3E4)

Accesses: READ_CONTROL

Privileges: - Restricted

Sid Count: 0



Windows Server 2003
To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 How to obtain the latest service pack for Windows Server 2003

Windows XP
This issue is fixed in the Microsoft COM+ hotfix rollup package that is discussed in Microsoft Knowledge Base article 910720. For more information about the hotfix rollup package, click the following article number to view the article in the Microsoft Knowledge Base:

910720 Availability of Windows XP COM+ Hotfix Rollup Package 12

Windows Server 2003
This issue is fixed in the COM+ hotfix rollup package that is discussed in Microsoft Knowledge Base article 910730. For more information about the hotfix rollup package, click the following article number to view the article in the Microsoft Knowledge Base:

910730 Availability of Windows Server 2003 Post-Service Pack 1 COM+ 1.5 Hotfix Rollup Package 7



STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section. This problem was first corrected in Windows Server 2003 Service Pack 2.



MORE INFORMATION
For more information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates

Keywords: kbbug kbfix kbqfe kbhotfixrollup kbwinserv2003sp1fix kbwinxppresp3fix kbwinserv2003sp2fix KB908473

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.