F
Fyboo
L.s.,
In the eventviewer I got audit failure messages 560.
----------------------------------------------------------------------
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\USER\.DEFAULT
Handle ID: -
Operation ID: {0,42785055}
Process ID: 1004
Image File Name: C:\WINNT\system32\svchost.exe
Primary User Name: servername$
Primary Domain: Domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: FS0002$
Client Domain: Domain
Client Logon ID: (0x0,0x3E7)
Accesses: MAX_ALLOWED
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x2000000
----------------------------------------------------------------------
I don't have any clue this behaviour occurs on my system. It has
nothing to do with starting Taskmanager, because the event occur also
at midnight. (and nobody is working at that moment)
So anybody?
In the eventviewer I got audit failure messages 560.
----------------------------------------------------------------------
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\USER\.DEFAULT
Handle ID: -
Operation ID: {0,42785055}
Process ID: 1004
Image File Name: C:\WINNT\system32\svchost.exe
Primary User Name: servername$
Primary Domain: Domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: FS0002$
Client Domain: Domain
Client Logon ID: (0x0,0x3E7)
Accesses: MAX_ALLOWED
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x2000000
----------------------------------------------------------------------
I don't have any clue this behaviour occurs on my system. It has
nothing to do with starting Taskmanager, because the event occur also
at midnight. (and nobody is working at that moment)
So anybody?