Sign in with
Sign up | Sign in
Your question

Auditing Object Access shows up when user open their own files!!!

Last response: in Windows 2000/NT
Share
August 19, 2007 1:23:22 AM

Running a windows 2003 domain. I have turned on Obejct access success,failure on in Active directory. I'm auditing my main file server for failure attempts on "list folders / read data". I'm getting alot of failure attempts showing from users accessing folders and file that the have accesses and infact that they are owners of. The Users get no access denied messeages and they can access the files. however its getting logged as follows:


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 18/08/2007
Time: 7:46:25 PM
User: DOMAIN\username
Computer: fileSERVER
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: D:\Fire Data\Bulletins\Response Book copy 2.xls
Handle ID: -
Operation ID: {0,9690251}
Process ID: 4
Image File Name:
Primary User Name: FileSERVER
Primary Domain: DOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: username
Client Domain: DOMAIN
Client Logon ID: (0x0,0x5B1CBD)
Accesses: DELETE
READ_CONTROL
ACCESS_SYS_SEC
ReadData (or ListDirectory)
ReadEA
ReadAttributes

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x1030089


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


If someone can help me!! I've checked everywhere, I've set this up on other networks and never seen this!!!!
September 19, 2007 8:56:26 PM

No one has anything, This is going to be the death of me! I've formated the server and just moved over the Data Partion and still get this!!!! for love of GOD someone suggest anything!!!
!