Audit errors are logged at every
MA Policy enforcement in the Windows Security logs:
|
Event Type:
|
Failure Audit
|
|
Event Source:
|
Security
|
|
Event Category:
|
Object Access
|
|
Event ID:
|
560
|
|
Date:
|
dd/mm/yyyy
|
|
Time:
|
hh:mm:ss
|
|
User:
|
<User_Name>
|
|
Computer:
|
<Computer_Name>
|
|
Description:
|
|
|
Object Open:
Object Server:
Object Type:
Object Name:
Handle ID:
Operation ID:
Process ID:
Image File Name:
Primary User Name:
Primary Domain:
Primary Logon ID:
Client User Name:
Client Domain:
Client Logon ID:
Accesses:
Restricted Sid Count:
Access Mask:
|
<Server Name>
SERVICE OBJECT
McShield
-
{0,69318563}
616
C:\WINDOWS\system32\services.exe
<UserName>$
<Domain_Name>
(0x0,0x###)
<Client_User_Name>
<Client_Domain>
<Client_Logon_ID>
Query status of service
Pause or continue the service
|
NOTE: In Windows 2008 and later, this event is reported as
Event 4656.
