Multiple errors recorded in the Security Event logs: Event ID: 560 or 4656

技術的な記事 ID: KB51187
最終更新: 2/9/2021

環境

McAfee VirusScan Enterprise (VSE) 8.x

問題

Audit errors are logged at every MA Policy enforcement in the Windows Security logs:

Event Type:	Failure Audit
Event Source:	Security
Event Category:	Object Access
Event ID:	560
Date:	dd/mm/yyyy
Time:	hh:mm:ss
User:	<User_Name>
Computer:	<Computer_Name>

NOTE: In Windows 2008 and later, this event is reported as Event 4656.

問題

Audit errors are logged during VSE on-demand scan in the Windows Security logs:

Event Type:	Failure Audit
Event Source:	Security
Event Category:	Object Access
Event ID:	4656
Date:	dd/mm/yyyy
Time:	hh:mm:ss
User:	<User_Name>
Computer:	<Computer_Name>
Description:
Object Open: Object Server: Object Type: Object Name: Handle ID: Process ID: Process Name: Accesses: WriteAttributes: Restricted Sid Count: Access Mask:	Security File C:Booten-USbootmgr.exe.mui 0x0 0x67c C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\Scan64.Exe SYNCHRONIZE: ReadAttributes WriteAttributes Not granted 0 0x100180

解決策

The issue is resolved in VSE 8.8 Patch 2 and later.

This behavior is expected if the same events are generated during a VSE on-demand scan. The events are generated when the on-demand scanner tries to preserve the 'last access time' of the files it scans.

VSE 8.8 Patch 16 is the latest patch available from the Downloads tab on the ServicePortal at https://support.mcafee.com/downloads.

NOTE: VSE 8.8 Patch 16 supports all supported Windows operating systems.

回避策

In the Security log, disable the ability to display Failure Audit errors:

Click Start, Run, type eventvprivwr.msc, and press Enter to start Windows Event Viewer.
Right-click Security Log and select Properties.
Click the Filter tab and deselect Failure Audit.
Click Apply, OK.
Close the Event Viewer.

影響を受ける製品

Known Issue/Product Defect
VirusScan Enterprise 8.8

言語:

この記事は、次の言語で表示可能です:

English United States
Japanese

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

Multiple errors recorded in the Security Event logs: Event ID: 560 or 4656

環境

問題

問題

解決策

回避策

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

Multiple errors recorded in the Security Event logs: Event ID: 560 or 4656

環境

問題

問題

解決策

回避策

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title