Re: Exchange 565 errors on many users



here are the two failures. Each time a user logs on, there are two of these
and two sucessful log entries. I will post the sucessful ones below:


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:28 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110055283}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F4F54)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
%{d74a876f-22b9-11d3-aa62-00c04f8eedd8}
%{d74a8774-2289-11d3-aa62-00c04f8eedd8}
Unknown specific access (bit 1)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
Unknown specific access (bit 8)
%{d74a8762-22b9-11d3-aa62-00c04f8eedd8}
Unknown specific access (bit 1)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
Unknown specific access (bit 7)
Unknown specific access (bit 9)
%{cf899a6a-afe6-11d2-aa04-00c04f8eedd8}
Unknown specific access (bit 8)
Unknown specific access (bit 9)
%{cffe6da4-afe6-11d2-aa04-00c04f8eedd8}
DELETE
WRITE_DAC
WRITE_OWNER
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{cfc7978e-afe6-11d2-aa04-00c04f8eedd8}
SYNCHRONIZE
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{cf4b9d46-afe6-11d2-aa04-00c04f8eedd8}
DELETE
SYNCHRONIZE
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 5)
%{d74a875e-22b9-11d3-aa62-00c04f8eedd8}
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 1)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{d0780592-afe6-11d2-aa04-00c04f8eedd8}
DELETE
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{d74a8769-22b9-11d3-aa62-00c04f8eedd8}
DELETE
WRITE_DAC
Unknown specific access (bit 0)
Unknown specific access (bit 1)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
%{d03a086e-afe6-11d2-aa04-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:26 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110048264}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F33E5)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
%{d0780592-afe6-11d2-aa04-00c04f8eedd8}
%{d03a086e-afe6-11d2-aa04-00c04f8eedd8}
%{cfc7978e-afe6-11d2-aa04-00c04f8eedd8}
%{cffe6da4-afe6-11d2-aa04-00c04f8eedd8}
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{d74a876f-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
Unknown specific access (bit 0)
Unknown specific access (bit 1)
Unknown specific access (bit 2)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
%{d74a8769-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{d74a8762-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
WRITE_DAC
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 6)
%{d74a875e-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{cf4b9d46-afe6-11d2-aa04-00c04f8eedd8}
READ_CONTROL
WRITE_DAC
SYNCHRONIZE
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 6)
%{cf899a6a-afe6-11d2-aa04-00c04f8eedd8}
DELETE
WRITE_OWNER
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
%{d74a8774-2289-11d3-aa62-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


These are the two "sucessful" entries:

Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:28 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110055282}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F4F54)
Accesses: -
Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
Unknown specific access (bit 8)
%{d74a8766-22b9-11d3-aa62-00c04f8eedd8}
%{cf0b3dc8-afe6-11d2-aa04-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


and


Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 2/7/2006
Time: 3:06:26 PM
User: FTC\cshane
Computer: GL-EXC-01
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=FLETC Organization/ou=First Administrative
Group/cn=Configuration/cn=Servers/cn=GL-VEX-01/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,110048263}
Process ID: 4248
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: GL-EXC-01$
Primary Domain: FTC
Primary Logon ID: (0x0,0x3E7)
Client User Name: cshane
Client Domain: FTC
Client Logon ID: (0x0,0x68F33E5)
Accesses: -
Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
Unknown specific access (bit 8)
%{d74a8766-22b9-11d3-aa62-00c04f8eedd8}
%{cf0b3dc8-afe6-11d2-aa04-00c04f8eedd8}

Access Mask: 0


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.


.



Relevant Pages

  • Re: Exchange 565 errors on many users
    ... I will post the sucessful ones below: ... Unknown specific access ... SYNCHRONIZE ... see Help and Support Center at ...
    (microsoft.public.exchange.admin)
  • Re: Exchange 565 errors on many users
    ... I will post the sucessful ones below: ... Unknown specific access ... SYNCHRONIZE ... see Help and Support Center at ...
    (microsoft.public.exchange.admin)
  • Exchange 2003 Security Event 565
    ... I am just starting to move users from my two Exchange 2000 to my ... Unknown specific access ... SYNCHRONIZE ... It is normaly followed by a success event but sometimes there is a lot morer ...
    (microsoft.public.exchange.admin)
  • RE: Event 565 - Security Audit Failures
    ... Unknown specific access ... > Exchange 2k3 server. ... as the users are accessing their mailboxes on the new ... > SYNCHRONIZE ...
    (microsoft.public.exchange.admin)
  • FreeBSD console weirdness when booting from usb stick
    ... They USB keyboard seems to do nothing, and during the boot process when the daemons are starting it seems like there is another keyboard attached on which the ENTER key is stuck. ... unknown: ... Handle 0x0000, DMI type 0, 24 bytes ... ESCD support is available ...
    (freebsd-questions)