Attack of the Event ID 565

i have windows server 2003 box dc, dns server, , exchange 2003 server. in security event log getting 50-100 events second this:

source: security
catagory: directory service access
event id: 565
user: nt authority\system

object open:
     object server:    security account manager
     object type:    sam_domain
     object name:    cn=builtin,dc=tmfteam,dc=com
     handle id:    129843432
     operation id:    {0,588717592}
     process id:    520
     process name:    c:\windows\system32\lsass.exe
     primary user name:    servername$
     primary domain:    servername
     primary logon id:    (0x0,0x3e7)
     client user name:    servername$
     client domain:    servername
     client logon id:    (0x0,0x3e7)
     accesses:    delete
            read_control
            write_dac
            write_owner
            readpasswordparameters
            writepasswordparameters
            readotherparameters
            writeotherparameters
            createuser
            createglobalgroup
            createlocalgroup
            getlocalgroupmembership
            listaccounts
           
     privileges:    -

     properties:
---
    %{19195a5a-6da0-11d0-afd3-00c04fd930c9}
delete
read_control
write_dac
write_owner
readpasswordparameters
writepasswordparameters
readotherparameters
writeotherparameters
createuser
createglobalgroup
createlocalgroup
getlocalgroupmembership
listaccounts
        %{c7407360-20bf-11d0-a768-00aa006e0529}
            %{bf9679a4-0de6-11d0-a285-00aa003049e2}
            %{bf9679a5-0de6-11d0-a285-00aa003049e2}
            %{bf9679a6-0de6-11d0-a285-00aa003049e2}
            %{bf9679bb-0de6-11d0-a285-00aa003049e2}
            %{bf9679c2-0de6-11d0-a285-00aa003049e2}
            %{bf9679c3-0de6-11d0-a285-00aa003049e2}
            %{bf967a09-0de6-11d0-a285-00aa003049e2}
            %{bf967a0b-0de6-11d0-a285-00aa003049e2}
        %{b8119fd0-04f6-4762-ab7a-4986c76b3f9a}
            %{bf967a34-0de6-11d0-a285-00aa003049e2}
            %{bf967a33-0de6-11d0-a285-00aa003049e2}
            %{bf9679c5-0de6-11d0-a285-00aa003049e2}
            %{bf967a61-0de6-11d0-a285-00aa003049e2}
            %{bf967977-0de6-11d0-a285-00aa003049e2}
            %{bf96795e-0de6-11d0-a285-00aa003049e2}
            %{bf9679ea-0de6-11d0-a285-00aa003049e2}
        %{ab721a52-1e2f-11d0-9819-00aa0040529b}

     access mask:    0

i'm sure has auditing, can't find turn off. i've checked of our group policies , none of them have directory service auditing enabled. i've checked security properties of server , domain, , neither of them have enabled either.

based on search have got extremely explained article give eye on it.




these events caused because microsoft exchange server accessing active directory user accounts.

microsoft exchange uses active directory accounts, , extends schema of accounts store exchange-related settings on accounts.  the "unknown specific access" entries mean windows system used @ logs, didn't natively know names of exhange-related properties being accessed.

failure audit events , "unknown specific access" events, while annoying, not in signs of problem on system.  if enable failure auditing see failures; windows , windows applications have code take care of failure doing different way.  for instance, if use word open document have read permission to, word try open document write- cause failure audit if failure auditing object access turned on.  however word won't crash or throw error; notify it's going open document read-only.  similarly exchange , many other windows applications similar things.

if symptom you're seeing failure audits, , exchange working properly, these can safely ignored.

if have problems using or administering exchange, should post 1 of exchange forums, , offer these audit events additional troubleshooting information.

if want these events go away, easiest way modify default domain controllers policy in administrative tools.  you can change computer settings\security settings\local policies\audit policy disable failure auditing ds object access category.

or, can change sacl on root of active directory, either remove failure accesses, or remove object types or accesses in question.



thanks , hope helps

---

syed khairuddin

Windows Server  >  Windows Server General Forum