Audit code meaning

G

Guest

Hi,

I have turn on auditing for event ID 560.
Would like to know what does "Accesses: SYNCHRONIZE, READ_CONTROL,
ReadAttributes, DELETE, ReadData (or ListDirectory)" means?

Would appreciate if someone can also point me the site where is state the
meaning.

Regards.
 
S

Steven L Umbach

Apparently you enabled auditing of object access which records when a user
is accessing a file in the operating system. Generally it is best to enable
auditing of object access only if you have a specific reason to such as then
enabling auditing on folders or files for access for permissions you want to
track. You will also see object access events recorded even if there is no
auditing configured on a folder/file. Refer to the link below for the
section on object access. --- Steve

http://www.microsoft.com/technet/security/prodtech/windows2000/secmod144.mspx
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Turning off event 560 1
Event ID 560 - IUSR Attempting to run MSPaint.exe 3
Audit Object Access Problem 4
Event ID 560 7 different errors 1
Regular Expressions Named Groups Problem 4
User Rights 4
SC Manager 0
Event ID 560 1

Top