Your auditing logs may contain incorrect auditing event details for event 565 and event 560

Event Type: Success Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 565
Description:
Object Open:
Object Server: Security Account Manager
Object Type: SAM_SERVER
Object Name: CN=Server,CN=System,DC=<domain_name>
Handle ID: 357683232
Operation ID: {0,19736110}
Process ID: 780
Process Name: C:\WINDOWS\system32\lsass.exe
Primary User Name: user_name
Primary Domain: domain_name
Primary Logon ID: (0x0,0x3E7)
Client User Name: user_name
Client Domain: domain_name
Client Logon ID: (0x0,0x12CEAE5)
Accesses READ_CONTROL
InitializeServer
EnumerateDomains
Undefined Access (no effect) Bit 7
Privileges -
Properties:
---
%{bf967aad-0de6-11d0-a285-00aa003049e2}
00x20094%20%21%22%23%24%25%26
--------------

• Event 565:

  Event Type: Success Audit
  Event Source: Security
  Event Category: Directory Service Access
  Event ID: 565
  Description:
  Object Open:
  Object Server: Security Account Manager
  Object Type: SAM_USER
  Object Name: <SID>
  Handle ID: 357684048
  Operation ID: {0,19736100}
  Process ID: 780
  Process Name: C:\WINDOWS\system32\lsass.exe
  Primary User Name: <user_name>
  Primary Domain: <domain_name>
  Primary Logon ID: (0x0,0x3E7)
  Client User Name: <user_name>
  Client Domain: <domain_name>
  Client Logon ID: (0x0,0x12CEAE5)
  Accesses:

• Event 560 where the matching handle close event has a different category than Event 565:

  Event Type: Success Audit
  Event Source: Security
  Event Category: Object Access
  Event ID: 562
  Description: Handle Closed:
  Object Server: Security Account Manager
  Handle ID: 357684048
  Process ID: 780
  Image File Name: C:\WINDOWS\system32\lsass.exe