Re: Exchange 565 errors on many users



here are the two failures. Each time a user logs on, there are two of these
and two sucessful log entries. I will post the sucessful ones below:


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:28 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110055283}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F4F54)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
%{d74a876f-22b9-11d3-aa62-00c04f8eedd8}
%{d74a8774-2289-11d3-aa62-00c04f8eedd8}
Unknown specific access (bit 1)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
Unknown specific access (bit 8)
%{d74a8762-22b9-11d3-aa62-00c04f8eedd8}
Unknown specific access (bit 1)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
Unknown specific access (bit 7)
Unknown specific access (bit 9)
%{cf899a6a-afe6-11d2-aa04-00c04f8eedd8}
Unknown specific access (bit 8)
Unknown specific access (bit 9)
%{cffe6da4-afe6-11d2-aa04-00c04f8eedd8}
DELETE
WRITE_DAC
WRITE_OWNER
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{cfc7978e-afe6-11d2-aa04-00c04f8eedd8}
SYNCHRONIZE
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{cf4b9d46-afe6-11d2-aa04-00c04f8eedd8}
DELETE
SYNCHRONIZE
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 5)
%{d74a875e-22b9-11d3-aa62-00c04f8eedd8}
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 1)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{d0780592-afe6-11d2-aa04-00c04f8eedd8}
DELETE
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{d74a8769-22b9-11d3-aa62-00c04f8eedd8}
DELETE
WRITE_DAC
Unknown specific access (bit 0)
Unknown specific access (bit 1)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
%{d03a086e-afe6-11d2-aa04-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:26 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110048264}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F33E5)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
%{d0780592-afe6-11d2-aa04-00c04f8eedd8}
%{d03a086e-afe6-11d2-aa04-00c04f8eedd8}
%{cfc7978e-afe6-11d2-aa04-00c04f8eedd8}
%{cffe6da4-afe6-11d2-aa04-00c04f8eedd8}
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{d74a876f-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
Unknown specific access (bit 0)
Unknown specific access (bit 1)
Unknown specific access (bit 2)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{d74a8769-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{d74a8762-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
WRITE_DAC
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 6)
%{d74a875e-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{cf4b9d46-afe6-11d2-aa04-00c04f8eedd8}
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{cf899a6a-afe6-11d2-aa04-00c04f8eedd8}
DELETE
WRITE_OWNER
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
%{d74a8774-2289-11d3-aa62-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


These are the two "sucessful" entries:

Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:28 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110055282}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F4F54)
Accesses: -
Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
Unknown specific access (bit 8)
%{d74a8766-22b9-11d3-aa62-00c04f8eedd8}
%{cf0b3dc8-afe6-11d2-aa04-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and


Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:26 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110048263}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F33E5)
Accesses: -
Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
Unknown specific access (bit 8)
%{d74a8766-22b9-11d3-aa62-00c04f8eedd8}
%{cf0b3dc8-afe6-11d2-aa04-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


.