|
Posted by kcsteele on March 4, 2008, 6:53 am
Please log in for more thread options bump
thanks
> Also the domain was originally NT4 and then upgraded to 2003. Perhaps
> there is something lingering from the NT4 domain that is causing the
> failures audits to be triggered?
>
>
>
>
> > Hello kcsteele,
>
> > You talk about the script. Is in the script an user account configured f=
or
> > some reason?
>
> > Best regards
>
> > Meinolf Weber
> > Disclaimer: This posting is provided "AS IS" with no warranties, and con=
fers
> > no rights.
> > ** Please do NOT email, only reply to Newsgroups
> > ** HELP us help YOU!!!http://www.blakjak.demon.co.uk/mul_crss.htm
>
> > > Hi, I'm getting failure audits in the security log of the PDC every
> > > time a user logs on or a computer refreshes computer policy:
>
> > > [USER]
>
> > > Event Type: =A0 =A0 Failure Audit
> > > Event Source: =A0 Security
> > > Event Category: Object Access
> > > Event ID: =A0 =A0 =A0 560
> > > Date: =A0 =A0 =A0 =A0 =A0 2/26/2008
> > > Time: =A0 =A0 =A0 =A0 =A0 7:12:15 AM
> > > User: =A0 =A0 =A0 =A0 =A0 DOMAIN\User
> > > Computer: =A0 =A0 =A0 DC
> > > Description:
> > > Object Open:
> > > Object Server: =A0Security
> > > Object Type: =A0 =A0File
> > > Object Name: =A0 =A0C:\WINDOWS\SYSVOL\domain\Policies\{0315E207-
> > > FA91-4913-8FE8-A2E4832A1BA7}\User\Scripts\Logon\track_logon.bat
> > > Handle ID: =A0 =A0 =A0-
> > > Operation ID: =A0
> > > Process ID: =A0 =A0 4
> > > Image File Name:
> > > Primary User Name: =A0 =A0 =A0DC$
> > > Primary Domain: DOMAIN
> > > Primary Logon ID: =A0 =A0 =A0 (0x0,0x3E7)
> > > Client User Name: =A0 =A0 =A0 user
> > > Client Domain: =A0DOMAIN
> > > Client Logon ID: =A0 =A0 =A0 =A0(0x0,0x4D8BED6)
> > > Accesses: =A0 =A0 =A0 READ_CONTROL
> > > ReadData (or ListDirectory)
> > > WriteData (or AddFile)
> > > AppendData (or AddSubdirectory or
> > > CreatePipeInstance)
> > > ReadEA
> > > WriteEA
> > > ReadAttributes
> > > WriteAttributes
> > > Privileges: =A0 =A0 -
> > > Restricted Sid Count: =A0 0
> > > Access Mask: =A0 =A00x2019F
> > > [COMPUTER]
>
> > > Event Type: =A0 =A0 Failure Audit
> > > Event Source: =A0 Security
> > > Event Category: Object Access
> > > Event ID: =A0 =A0 =A0 560
> > > Date: =A0 =A0 =A0 =A0 =A0 2/26/2008
> > > Time: =A0 =A0 =A0 =A0 =A0 7:14:28 AM
> > > User: =A0 =A0 =A0 =A0 =A0 DOMAIN\WORKSTATION$
> > > Computer: =A0 =A0 =A0 DC
> > > Description:
> > > Object Open:
> > > Object Server: =A0Security
> > > Object Type: =A0 =A0File
> > > Object Name: =A0 =A0C:\WINDOWS\SYSVOL\domain\Policies\{DFBF9311-
> > > F537-4423-
> > > A1D6-D225FC445774}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf
> > > Handle ID: =A0 =A0 =A0-
> > > Operation ID: =A0
> > > Process ID: =A0 =A0 4
> > > Image File Name:
> > > Primary User Name: =A0 =A0 =A0DC$
> > > Primary Domain: DOMAIN
> > > Primary Logon ID: =A0 =A0 =A0 (0x0,0x3E7)
> > > Client User Name: =A0 =A0 =A0 WORKSTATION$
> > > Client Domain: =A0DOMAIN
> > > Client Logon ID: =A0 =A0 =A0 =A0(0x0,0x4D92D17)
> > > Accesses: =A0 =A0 =A0 READ_CONTROL
> > > ReadData (or ListDirectory)
> > > WriteData (or AddFile)
> > > AppendData (or AddSubdirectory or
> > > CreatePipeInstance)
> > > ReadEA
> > > WriteEA
> > > ReadAttributes
> > > WriteAttributes
> > > Privileges: =A0 =A0 -
> > > Restricted Sid Count: =A0 0
> > > Access Mask: =A0 =A00x2019F
> > > This is accompanied by failure audits for each separate logon script
> > > (startup script in the case of computers, not users). The strange
> > > thing is that the scripts still run no problem. I'm trying to figure
> > > out why there are failures getting triggered if the logon/startup
> > > scripts still run successfully. I checked the NTFS ACL on the
> > > track_logon.bat referenced in the first event, and it has read and
> > > read&execute allowed for "authenticated users".
>
> > > Thanks if anyone can provide any more info.- Hide quoted text -
>
> > - Show quoted text -- Hide quoted text -
>
> - Show quoted text -
| 
XML Sitemap