Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

FIX: A Failure Audit event with event ID 560 appears in the Security log when you enable object auditing in Windows XP or in Windows Server 2003


View products that this article applies to.

Symptoms

When you enable object auditing in Microsoft Windows XP or in Microsoft Windows Server 2003, a Failure Audit event with event ID 560 appears in the Security log. The event entry will appear similar to the following:


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: <date>
Time: <time>
User: NT AUTHORITY\SYSTEM
Computer: <computer_name>
Description:
Object Open:
Object Server: SC Manager
Object Type: <Object_type>
Object Name: <Object_name>
Handle ID: -
Operation ID: {0,42016}
Process ID: 616
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: <username>
Primary Domain: <domain>
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: READ_CONTROL
Privileges: - Restricted
Sid Count: 0

↑ Back to the top


Resolution

Service pack information

Windows Server 2003

To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
889100 How to obtain the latest service pack for Windows Server 2003

Hotfix rollup package information

Windows XP

This issue is fixed in the Microsoft COM+ hotfix rollup package that is discussed in Microsoft Knowledge Base article 910720. For more information about the hotfix rollup package, click the following article number to view the article in the Microsoft Knowledge Base:
910720 Availability of Windows XP COM+ Hotfix Rollup Package 12

Windows Server 2003

This issue is fixed in the COM+ hotfix rollup package that is discussed in Microsoft Knowledge Base article 910730. For more information about the hotfix rollup package, click the following article number to view the article in the Microsoft Knowledge Base:
910730 Availability of Windows Server 2003 Post-Service Pack 1 COM+ 1.5 Hotfix Rollup Package 7

↑ Back to the top


Status

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section. This problem was first corrected in Windows Server 2003 Service Pack 2.

↑ Back to the top


More information

For more information, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates

↑ Back to the top


Keywords: kbwinserv2003sp2fix, kbfix, kbbug, kbqfe, kbwinserv2003sp1fix, kbwinxppresp3fix, kbhotfixrollup, KB908473

↑ Back to the top

Article Info
Article ID : 908473
Revision : 7
Created on : 10/11/2007
Published on : 10/11/2007
Exists online : False
Views : 720