Multiple errors recorded in the Security Event logs: Event ID: 560 or 4656

技術的な記事 ID: KB51187
最終更新: 2/9/2021

環境

McAfee VirusScan Enterprise (VSE) 8.x

問題

Audit errors are logged at every MA Policy enforcement in the Windows Security logs:

Event Type:	Failure Audit
Event Source:	Security
Event Category:	Object Access
Event ID:	560
Date:	dd/mm/yyyy
Time:	hh:mm:ss
User:	<User_Name>
Computer:	<Computer_Name>

NOTE: In Windows 2008 and later, this event is reported as Event 4656.

問題

Audit errors are logged during VSE on-demand scan in the Windows Security logs:

Event Type:	Failure Audit
Event Source:	Security
Event Category:	Object Access
Event ID:	4656
Date:	dd/mm/yyyy
Time:	hh:mm:ss
User:	<User_Name>
Computer:	<Computer_Name>
Description:
Object Open: Object Server: Object Type: Object Name: Handle ID: Process ID: Process Name: Accesses: WriteAttributes: Restricted Sid Count: Access Mask:	Security File C:Booten-USbootmgr.exe.mui 0x0 0x67c C:\Program Files (x86)\McAfee\VirusScan Enterprise\x64\Scan64.Exe SYNCHRONIZE: ReadAttributes WriteAttributes Not granted 0 0x100180

解決策

The issue is resolved in VSE 8.8 Patch 2 and later.

This behavior is expected if the same events are generated during a VSE on-demand scan. The events are generated when the on-demand scanner tries to preserve the 'last access time' of the files it scans.

{VSE88PATCHES.EN_US}

回避策

In the Security log, disable the ability to display Failure Audit errors:

Click Start, Run, type eventvprivwr.msc, and press Enter to start Windows Event Viewer.
Right-click Security Log and select Properties.
Click the Filter tab and deselect Failure Audit.
Click Apply, OK.
Close the Event Viewer.

影響を受ける製品

Known Issue/Product Defect
VirusScan Enterprise 8.8

言語:

この記事は、次の言語で表示可能です:

English United States
Japanese

技術用語集

用語集にある用語をハイライトする

当社の技術用語集を参照してください。

Knowledge Center

Multiple errors recorded in the Security Event logs: Event ID: 560 or 4656

環境

問題

問題

解決策

回避策

影響を受ける製品

言語:

技術用語集

Title

Title

Knowledge Center

Multiple errors recorded in the Security Event logs: Event ID: 560 or 4656

環境

問題

問題

解決策

回避策

影響を受ける製品

言語:

技術用語集

地域を選択してください

Title

Title