Security Events / Object Access / Failure audit

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: ScottT (ScottT_at_discussions.microsoft.com)
Date: 02/18/05 

Date: Fri, 18 Feb 2005 02:31:04 -0800

Hi,
I've enabled the Audit on "object Access" on some XP SP2 workstations.
My Security event log is full of events such as:

Source: Security
Category: Object Access
Tyope: Failure audit
Event ID: 560
User: XXX
Computer: YYYY

Description
Object Open:
   Object Server: Security
   Object type: Mutant (or Event)
   Object Name: \BaseNamedObjects\ZonesLockedCacheCounterMutex
   Handle ID: -
   Operation ID: {0,92870}
   Process ID: 1692
   Image File Name: c:\windows\explorer.exe
   Primary User Name: Administrator
   Primary Domain: <<computername>>
   Primary Logon ID: (0x0,0x 130BD)
   Client User name: -
   Client Domain: -
   Client Logon ID: -
   Accesses: DELETE
                  READ_CONTROL
                  WRITE_DAC
                  WRITE OWNER
                  SYNCHRONIZE
                  Query Mutant State

Can some one tell me to which topic is it related to or to explain me what
such message means ?

Thank you very much.

ScottT

Relevant Pages

  • Re: Security Audit
    ... Subject: Security Audit ... > A zero knowledge pen test ... manner that is useful and pertinent to the client. ...
    (Pen-Test)
  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)
  • Re: How to determine who changed permissions on a directory?
    ... I used the "Security Monitoring and Attack Detection Planning Guide" from ... Audit Account Logon events - Success, Failure ... Audit Object Access - Success, ...
    (microsoft.public.security)
  • Re: User activity log
    ... You can enable auditing of object access in Local Security Policy or the ... folders/files you want to track. ... For instance you can audit an executable ...
    (microsoft.public.windows.server.security)
  • Re: Security Audit
    ... Subject: Security Audit ... money and that customers don't want more stringent card security methods. ... > manner that is useful and pertinent to the client. ... > as communicated by the consulting firm. ...
    (Pen-Test)