errors access permissions counter

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

I am trying to find the root cause of some performance issues one of my
servers has been experienceing and in the proces, stumbled across the "errors
access permissions counter" in the server object of performance monitor. I
checkde on a couple of servers and it seems that the numbers I see are very
high - thousands and ten thousands. Does anyone know more about this
counter? I have tried to audit failed file read access, but my audit results
are more in the 1-5 range and not near the thousands I see for the counter.
ANy help would be appreciated.

 

[jvh1003]

These alerts are based on failure audits of "object access" in the auditing policy. You would think that enabling this in the domain policy, local policy, etc would be enough. Not true. For the failure audits to appear in event viewer, you must enable auditing on the specific resource. On the desired drive/folder/file (whichever you choose), access the security options. Click advanced, then the auditing tab. Choose the users you would like to audit (usually would be the Everyone group). Voila! The failure audits will start appearing in the security event viewer log.