Event ID 4662 Audit Failure Direcory Service Access
Hi,
Can anyone give me some suggestion what should I look to avoid this kind on errors?
I'v done DC migration from 2003R2 to 2008R2.
Everyting seems working witout problems. I just don't want to disable Direcory Service Access auditing I want to find out
what's going on and why is that?
I'm seeing similar erros with User accounts too, but I don't want at the moment fill my first post with errors regarding Users.. later..
An operation was performed on an object.
Subject :
Security ID: KOPLI\LAPTOP-006$
Account Name: LAPTOP-006$
Account Domain: KOPLI
Logon ID: 0x20de7a
Object:
Object Server: DS
Object Type: computer
Object Name: CN=LAPTOP-006,OU=Laptop SAF W7,DC=CONTOSO,DC=COM
Handle ID: 0x0
Operation:
Operation Type: Object Access
Accesses: Write Property
Access Mask: 0x20
Properties: ---
{e48d0154-bcf8-11d1-8702-00c04fb96050}
{f3a64788-5306-11d1-a9c5-0000f80367c1}
{bf967a86-0de6-11d0-a285-00aa003049e2}
Additional Information:
Parameter 1: -
Parameter 2:
rgds Sven
October 17th, 2011 4:41am
Anybody?..rgds Sven
Free Windows Admin Tool Kit Click here and download it now
October 19th, 2011 2:52am
Hi,
This event is related to the Global audit policy. Please refer to the following article for more information:
http://technet.microsoft.com/en-us/library/cc731607(WS.10).aspx
Regards,
Bruce
October 24th, 2011 5:45am
If auditing is enabled then OU creation/deletion/move configured
The above event will be logged if Directory Service Access in auditing is enabled.
http://support.microsoft.com/kb/232714
http://technet.microsoft.com/en-us/library/cc728087(WS.10).aspxVinod H
Free Windows Admin Tool Kit Click here and download it now
October 24th, 2011 6:58am
This Indicates that the AD object was accesses by user, and is the the failure. If you don't want to receive this events, then disable the auditing.
Note:
This event occurs only on Domain Controllers.Vinod H
November 2nd, 2011 3:31am
This Indicates that the AD object was accesses by user, and is the the failure. If you don't want to receive this events, then disable the auditing.
Note:
This event occurs only on Domain Controllers.
Vinod H
Hi,
Only access? But here is written:
Operation Type: Object Access
Accesses: Write Property <- what does this mean? As I understand then COMPUTERACCOUNT wants to write something..?rgds Sven
Free Windows Admin Tool Kit Click here and download it now
November 2nd, 2011 5:13am
Hi everyone,
I have the same question as Sven.
Are these events failure?
Or only information, that the user has accessed an AD-object?
Greetings
Stefan
May 30th, 2012 3:16am