Hi I am facing similar problem as above on my Domain controller(Windows 2003 server). Too many 566 events are generated and filling up the Security log. I have observed that 2 events were getting generated per Object Name with different set of Properties. All the events are generated with the same "User". The sample events are provided below. The Audit policy for Object Access (i.e. "Audit object access") is Not Defined. The default behaviour should be not to generate Object Access events but they are still getting generated. Am I missing something? I do not want these events to be generated. Is there any other setting to disable these events? Please help me. Event Type: Success Audit Event Source: Security Event Category: (8) Event ID: 566 Date: 6/21/2011 Time: 5:54:42 PM User: MYDOMAIN\user1 Computer: XYZHOST Description: Object Operation: Object Server: DS Operation Type: Object Access Object Type: computer Object Name: CN=abchost,CN=Computers,DC=mydomain,DC=net Handle ID: - Primary User Name: XYZHOST$ Primary Domain: MYDOMAIN Primary Logon ID: (0x0,0x3E7) Client User Name: user1 Client Domain: MYDOMAIN Client Logon ID: (0x0,0x7AC5A7C1) Accesses: Read Property Properties: Read Property Public Information distinguishedName computer Additional Info: Additional Info2: Access Mask: 0x10 Event Type: Success Audit Event Source: Security Event Category: (8) Event ID: 566 Date: 6/21/2011 Time: 5:54:42 PM User: MYDOMAIN\user1 Computer: XYZHOST Description: Object Operation: Object Server: DS Operation Type: Object Access Object Type: computer Object Name: CN=abchost,CN=Computers,DC=mydomain,DC=net Handle ID: - Primary User Name: XYZHOST$ Primary Domain: MYDOMAIN Primary Logon ID: (0x0,0x3E7) Client User Name: user1 Client Domain: MYDOMAIN Client Logon ID: (0x0,0x7AC5A7C1) Accesses: Read Property Properties: Read Property Public Information objectGUID computer Additional Info: Additional Info2: Access Mask: 0x10 Thanks in advance.