Question : repeating Failure Audit error in event log

I keep getting this in my security log on Small Business Server 2003 and I am not finding anything outthere to tell me what it is. Has anyone seen this one or tell me what to look for? I happens throughout the day and night and many times twice with in the same minute but not always.

Event Type:      Failure Audit
Event Source:      Security
Event Category:      Object Access
Event ID:      560
Date:            5/16/2006
Time:            11:00:18 PM
User:            NT AUTHORITY\NETWORK SERVICE
Computer:      HOCSBS
Description:
Object Open:
       Object Server:      SC Manager
       Object Type:      SERVICE OBJECT
       Object Name:      WinHttpAutoProxySvc
       Handle ID:      -
       Operation ID:      {0,464755939}
       Process ID:      668
       Image File Name:      C:\WINDOWS\system32\services.exe
       Primary User Name:      HOCSBS$
       Primary Domain:      HOC
       Primary Logon ID:      (0x0,0x3E7)
       Client User Name:      NETWORK SERVICE
       Client Domain:      NT AUTHORITY
       Client Logon ID:      (0x0,0x3E4)
       Accesses:      Query status of service
                  Start the service
                  Query information from service
                  
       Privileges:      -
       Restricted Sid Count:      0
       Access Mask:      0x94


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Thanks,
Mark

Answer : repeating Failure Audit error in event log

>>>>>>User:          NT AUTHORITY\NETWORK SERVICE

This is used by ISA Server,

IF the ISA server is installed on your SBS
Is advance logging is enabled in the ISA, i mean is it using the MSDE server???

have a look here
http://72.14.209.104/search?q=cache:6qQ-APJCfqQJ:www.windowsnetworking.com/kbase/WindowsTips/WindowsNT/AdminTips/EventLogs/W2KandNTSecurityEventLogDescriptions.html+Event+id:+560++++Failure+Audit+Network+service+ISA+server&hl=en&gl=au&ct=clnk&cd=1

if you dont have an ISA server on it
check this out
http://support.microsoft.com/kb/908473

I guess you are having the ISA server

regards
Naren


Random Solutions  
 
programming4us programming4us