Auditing Object Access shows up when user open their own files!!!

Running a windows 2003 domain. I have turned on Obejct access success,failure on in Active directory. I'm auditing my main file server for failure attempts on "list folders / read data". I'm getting alot of failure attempts showing from users accessing folders and file that the have accesses and infact that they are owners of. The Users get no access denied messeages and they can access the files. however its getting logged as follows:

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 18/08/2007
Time: 7:46:25 PM
User: DOMAIN\username
Computer: fileSERVER
Object Open:
Object Server: Security
Object Type: File
Object Name: D:\Fire Data\Bulletins\Response Book copy 2.xls
Handle ID: -
Operation ID: {0,9690251}
Process ID: 4
Image File Name:
Primary User Name: FileSERVER
Primary Domain: DOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: username
Client Domain: DOMAIN
Client Logon ID: (0x0,0x5B1CBD)
Accesses: DELETE
ReadData (or ListDirectory)

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x1030089

For more information, see Help and Support Center at

If someone can help me!! I've checked everywhere, I've set this up on other networks and never seen this!!!!
1 answer Last reply
More about auditing object access shows user open files
  1. No one has anything, This is going to be the death of me! I've formated the server and just moved over the Data Partion and still get this!!!! for love of GOD someone suggest anything!!!
Ask a new question

Read More

Windows Server 2003 Domain Active Directory Windows