Help - Security Event Log Posts Error Event ID 560 every few seconds!

Server 2003 SE SP1 5.2.3790
Sql Server 2000, SP 4, 8.00.2039
We fixed one issue, but it brought up another. the fix we applied
stopped the ServicesActive access failure, but now we have a failure
on MSSEARCH. The users this is affecting do NOT have admin rights on
the machine, they are SQL developers.
We were having
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/23/2007
Time: 6:27:15 AM
User: domain\user
Computer: MACHINENAME
Description:
Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,1623975729}
Process ID: 840
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: MACHINE$
Primary Domain: Domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: User
Client Domain: Domain
Client Logon ID: (0x0,0x6097C608)
Accesses: READ_CONTROL
Connect to service controller
Enumerate services
Query service database lock state
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x20015
Applied the following fix
http://support.microsoft.com/kb/907460/
Now we are getting
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/23/2007
Time: 10:51:23 AM
User: domain\user
Computer: MACHINE
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: MSSEARCH
Handle ID: -
Operation ID: {0,1627659603}
Process ID: 840
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: MACHINE$
Primary Domain: domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: user
Client Domain: domain
Client Logon ID: (0x0,0x60D37C1A)
Accesses: READ_CONTROL
Query service configuration information
Query status of service
Enumerate dependencies of service
Query information from service
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x2008DThere are post-SP4 hotfixes that can be applied:
http://aspfaq.com/SQL2000Builds.asp
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA, MCITP, MCTS
SQL Server MVP
Toronto, ON Canada
https://mvp.support.microsoft.com/profile/Tom.Moreau
"David Hay" <david.hay@.gmail.com> wrote in message
news:1180007534.344206.147240@.u30g2000hsc.googlegroups.com...
Server 2003 SE SP1 5.2.3790
Sql Server 2000, SP 4, 8.00.2039
We fixed one issue, but it brought up another. the fix we applied
stopped the ServicesActive access failure, but now we have a failure
on MSSEARCH. The users this is affecting do NOT have admin rights on
the machine, they are SQL developers.
We were having
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/23/2007
Time: 6:27:15 AM
User: domain\user
Computer: MACHINENAME
Description:
Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,1623975729}
Process ID: 840
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: MACHINE$
Primary Domain: Domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: User
Client Domain: Domain
Client Logon ID: (0x0,0x6097C608)
Accesses: READ_CONTROL
Connect to service controller
Enumerate services
Query service database lock state
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x20015
Applied the following fix
http://support.microsoft.com/kb/907460/
Now we are getting
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 5/23/2007
Time: 10:51:23 AM
User: domain\user
Computer: MACHINE
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: MSSEARCH
Handle ID: -
Operation ID: {0,1627659603}
Process ID: 840
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: MACHINE$
Primary Domain: domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: user
Client Domain: domain
Client Logon ID: (0x0,0x60D37C1A)
Accesses: READ_CONTROL
Query service configuration information
Query status of service
Enumerate dependencies of service
Query information from service
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x2008D|||Tom,
Thanks. I don't see any fix beyond SP4 that address' this issue, but
I appreciate the link. I'll try and get to the latest build over
Monthend!
On May 24, 7:56 am, "Tom Moreau" <t...@.dont.spam.me.cips.ca> wrote:
> There are post-SP4 hotfixes that can be applied:
> http://aspfaq.com/SQL2000Builds.asp
> --
> Tom
>|||There was an issue with SP4 turning off AWE. Hotfixes are your friend. ;-)
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA, MCITP, MCTS
SQL Server MVP
Toronto, ON Canada
https://mvp.support.microsoft.com/profile/Tom.Moreau
"David Hay" <david.hay@.gmail.com> wrote in message
news:1180013455.778429.265380@.h2g2000hsg.googlegroups.com...
Tom,
Thanks. I don't see any fix beyond SP4 that address' this issue, but
I appreciate the link. I'll try and get to the latest build over
Monthend!
On May 24, 7:56 am, "Tom Moreau" <t...@.dont.spam.me.cips.ca> wrote:
> There are post-SP4 hotfixes that can be applied:
> http://aspfaq.com/SQL2000Builds.asp
> --
> Tom
>|||Thanks again, this the first I even heard of AWE... since I have 4
gig fo ram I better put in the fixes!
On May 24, 11:13 am, "Tom Moreau" <t...@.dont.spam.me.cips.ca> wrote:
> There was an issue with SP4 turning off AWE. Hotfixes are your friend. ;
-)
> --
> Tom|||I applied all the hotfixes over the weekend. I am still getting the
security error on MSSEARCH.
Any other idea's?
David
On May 24, 11:13 am, "Tom Moreau" <t...@.dont.spam.me.cips.ca> wrote:
> There was an issue with SP4 turning off AWE. Hotfixes are your friend. ;
-)
> --
> Tom
>|||I've scoured the MS website and came up with squat. You may need to call
Product Support and open a ticket.
Tom
----
Thomas A. Moreau, BSc, PhD, MCSE, MCDBA, MCITP, MCTS
SQL Server MVP
Toronto, ON Canada
https://mvp.support.microsoft.com/profile/Tom.Moreau
"David Hay" <david.hay@.gmail.com> wrote in message
news:1180469042.970043.254730@.o5g2000hsb.googlegroups.com...
I applied all the hotfixes over the weekend. I am still getting the
security error on MSSEARCH.
Any other idea's?
David
On May 24, 11:13 am, "Tom Moreau" <t...@.dont.spam.me.cips.ca> wrote:
> There was an issue with SP4 turning off AWE. Hotfixes are your friend.
> ;-)
> --
> Tom
>|||Thanks! If/When I get an answer I'll be sure to add it to the thread!
David
On May 29, 6:59 pm, "Tom Moreau" <t...@.dont.spam.me.cips.ca> wrote:
> I've scoured the MS website and came up with squat. You may need to call
> Product Support and open a ticket.
> --
> Tom