G
Guest
I allowed auditing failed registry events and managed to fix many software
problems when running programs not under Administrator account. However cant
understand this bad one
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 23.10.2004
Time: 2:34:54
User: NT AUTHORITY\SYSTEM
Computer: SERVER-PII
Description:
Object Open:
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\USER\.DEFAULT
Handle ID: -
Operation ID: {0,27965001}
Process ID: 976
Image File Name: C:\WINDOWS\system32\svchost.exe
Primary User Name: SERVER-PII$
Primary Domain: NETWORK
Primary Logon ID: (0x0,0x3E7)
Client User Name: SERVER-PII$
Client Domain: NETWORK
Client Logon ID: (0x0,0x3E7)
Accesses: MAX_ALLOWED
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x2000000
What does "MAX_ALLOWED" Access mean? I have quite many these events. How can
I fix this?
Regards,
Andy
problems when running programs not under Administrator account. However cant
understand this bad one
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 23.10.2004
Time: 2:34:54
User: NT AUTHORITY\SYSTEM
Computer: SERVER-PII
Description:
Object Open:
Object Server: Security
Object Type: Key
Object Name: \REGISTRY\USER\.DEFAULT
Handle ID: -
Operation ID: {0,27965001}
Process ID: 976
Image File Name: C:\WINDOWS\system32\svchost.exe
Primary User Name: SERVER-PII$
Primary Domain: NETWORK
Primary Logon ID: (0x0,0x3E7)
Client User Name: SERVER-PII$
Client Domain: NETWORK
Client Logon ID: (0x0,0x3E7)
Accesses: MAX_ALLOWED
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x2000000
What does "MAX_ALLOWED" Access mean? I have quite many these events. How can
I fix this?
Regards,
Andy