Help - Security Event Log Posts Error Event ID 560 every few seconds

Server 2003 SE SP1 5.2.3790
Sql Server 2000, SP 4, 8.00.2187 (latest hotfix rollup)

We fixed one issue, but it brought up another. the fix we applied stopped the ServicesActive access failure, but now we have a failure on MSSEARCH. The users this is affecting do NOT have admin rights on the machine, they are SQL developers.

We were having

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/23/2007

Time: 6:27:15 AM
User: domain\user
Computer: MACHINENAME
Description:
Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,1623975729}
Process ID: 840
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: MACHINE$
Primary Domain: Domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: User
Client Domain: Domain
Client Logon ID: (0x0,0x6097C608)
Accesses: READ_CONTROL
Connect to service controller
Enumerate services
Query service database lock state

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x20015

Applied the following fix

http://support.microsoft.com/kb/907460/

Now we are getting

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/23/2007
Time: 10:51:23 AM
User: domain\user
Computer: MACHINE
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: MSSEARCH
Handle ID: -
Operation ID: {0,1627659603}
Process ID: 840
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: MACHINE$
Primary Domain: domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: user
Client Domain: domain
Client Logon ID: (0x0,0x60D37C1A)
Accesses: READ_CONTROL
Query service configuration information
Query status of service
Enumerate dependencies of service
Query information from service

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x2008D

Please let us know if the problem has been resolved. If not, please let us know, we will need more information (if possible the SQL Server error message) in order to help.

Thanks a lot,

-Raul Garcia

SDE/T

SQL Server Engine

|||

No this problem has not been resolved. All logs are/have been posted.

David Hay

|||

I am afraid the information you included is not enough for us to determine the cause of these failures. I would recommend contacting Microsoft Premier Support.

Thanks,

-Raul Garcia

SDE/T

SQL Server Engine