Microsoft KB Archive/245630

= Event 560 Failures Appears When File and Object Auditing Is Enabled =

Article ID: 245630

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT 4.0 Service Pack 1
 * Microsoft Windows NT 4.0 Service Pack 2
 * Microsoft Windows NT 4.0 Service Pack 3
 * Microsoft Windows NT 4.0 Service Pack 4
 * Microsoft Windows NT 4.0 Service Pack 5
 * Microsoft Windows NT 4.0 Service Pack 6

-



This article was previously published under Q245630



SYMPTOMS
When File and Object auditing is enabled in Windows NT 4.0, you may receive Event 560 failures in the event log.



CAUSE
This behavior can occur when the task manager is polling, or is going out through the computer and reading objects.

This error also occurs on computers running Windows 2000. The registry key is set to 1 by enabling the group policy item. Audit access to global system objects and auditing on object access. Disabling this setting the group policy requires a reboot of the machine after the group policy item is updated.



STATUS
Microsoft has confirmed that this is a problem in Windows NT 4.0.



MORE INFORMATION
The audit failure occurs when the AuditBaseObjects value is enabled in the following registry key:

HKEY_LOCAL_MACHINE\system\CurrentControlSet\Control\Lsa

The event log that appears during each polling interval of Task Manager appears like this:

User = cso_admin

Event ID = 560

Source = Security

Type = Failure Audit

Category = Object Access

Description:

Object Open:

Object Server: Security

Object Type: Desktop

Object Name: \Winlogon

New Handle ID: -

Operation ID: {0,57614}

Process ID: 2157796800

Primary User Name: cso_admin

Primary Domain: BNTEMP

Primary Logon ID: (0x0,0x5ED9)

Client User Name: -

Client Domain: -

Client Logon ID: -

Accesses MAX_ALLOWED

Read Objects

Write objects

Keywords: kberrmsg kbprb KB245630

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.