|
Posted by Roger Abell [MVP] on October 7, 2005, 3:29 am
If you were Registered and logged in, you could reply and use other advanced thread options
The short explaination is that something that was then running
in process with ID 388 tried to get access to manage services
and was not allowed to do so.
> What does this event mean? Thanks, ChrisW.
>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Object Access
> Event ID: 560
>
> Description:
> Object Open:
> Object Server: SC Manager
> Object Type: SC_MANAGER OBJECT
> Object Name: ServicesActive
> New Handle ID: -
> Operation ID:
> Process ID: 388
> Primary User Name:
> Primary Domain:
> Primary Logon ID: (0x0,0x3E7)
> Client User Name:
> Client Domain:
> Client Logon ID: (0x0,0x2C7D6FA)
> Accesses DELETE
> READ_CONTROL
> WRITE_DAC
> WRITE_OWNER
> Connect to service controller
> Create a new service
> Enumerate services
> Lock service database for exclusive access
> Query service database lock state
> Set last-known-good state of service database
>
>
> Privileges -
>
>
> Reply
>
| 
XML site map