RE: Security Audit displays "Success" when it should be "Failure"

RandyFranklinSmith — Tue, 16 Feb 2010 03:40:23 GMT

Where do I begin?

1. 565 is not an Object Access event - it is a Directory Service access event

2. Windows doesn't log attempts to open a file unless you enable Object Access auditing AND enable auditing for that file

3. Since trying to open an EFS encrypted file is not a permissions failure I'm not sure #2 would log an event anyway

4. As to logon events, please see my free webinars on the subject at www.ultimatewindowssecurity.com/webinars

Security Audit displays "Success" when it should be "Failure"

LynneBarton — Thu, 11 Feb 2010 18:11:50 GMT

I created an encrypted file as an Administrator and then as another user later I logged on and tried to open the file. I got an "Access Denied" error but to my surprise the security log for #565 showed the type "Success Audit." I don't know why I had a positive entry.

More specifically, I had the Administrator log onto a Virtual Server (Windows 2003) and left it open. Then I logged on as another test user using remote desktop. I could not see the security log as that user since I did not have permissions. (I looked into that but couldn't seem to find the settings that would give the test user a way to see the security log. How do I do that?)

Anyway, I looked later in the Administrator's Virtual PC and I saw the security log indicate a successful logon. What is going on? Why is it wrong about a failure?

Thanks!

UltimateWindowsSecurity.com Forum / Ultimate Windows Security Forum / Security Log / 565 - Object Open (Active Directory) / Security Audit displays "Success" when it should be "Failure" / Latest Posts

RE: Security Audit displays "Success" when it should be "Failure"

Security Audit displays "Success" when it should be "Failure"