none
Object Access Failure were found when certain schedule task executed in Windows Server 2003

    Question

  • We are using Windows Server 2003 and we found that a number of Object Access Security Failure  existed when the server executed the schedule task each time. The following message was one of the failure event found in the Security event log.

    Event Type:    Failure Audit
    Event Source:    Security
    Event Category:    Object Access
    Event ID:    560
    Date:        26/4/2013
    Time:        18:00:19
    User:        GLD-PCMS-INT01\pcmsbatch
    Computer:    GLD-PCMS-INT01
    Description:
    Object Open:
         Object Server:    SC Manager
         Object Type:    SC_MANAGER OBJECT
         Object Name:    ServicesActive
         Handle ID:    -
         Operation ID:    {2,728789638}
         Process ID:    460
         Image File Name:    C:\WINDOWS\system32\services.exe
         Primary User Name:    GLD-PCMS-INT01$
         Primary Domain:    WORKGROUP
         Primary Logon ID:    (0x0,0x3E7)
         Client User Name:    pcmsbatch
         Client Domain:    GLD-PCMS-INT01
         Client Logon ID:    (0x2,0x2B6E3F3B)
         Accesses:    READ_CONTROL
                Connect to service controller
                Enumerate services
                Query service database lock state
                
         Privileges:    -
         Restricted Sid Count:    0
         Access Mask:    0x20015


    For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

    Please advise.


    Elliott Ma.

    Friday, May 10, 2013 2:44 AM

All replies

  • This one may help.

    http://support.microsoft.com/kb/841001

     

     

     


    Regards, Dave Patrick ....
    Microsoft Certified Professional
    Microsoft MVP [Windows]

    Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

    Friday, May 10, 2013 2:58 AM
  • Hi Dave,

    We have checked that the setting "Audit the access of global systems objects" has bee disabled already. And the user "GLD-PCMS-INT01\pcmsbatch" to access the objects is a local user instead of domain user.


    Elliott Ma.

    Monday, May 13, 2013 2:48 AM