Event 565, Directory Service Acces, Failure Audit

[ReddLefty]

This error has been bugging me. I found nothing on Technet or Event.ID that has bearing on this issue. This error occures EVERY MINUTE in my logs. This is coming from my PDC Security Log. It does not seem to affect the server operations in any way, but I have a bit of free time and I thought I would try to tackle it:


Event Type: Failure Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 565
Date: 8/12/2004
Time: 12:00:32 PM
User: MYDOMAIN\MAILSERVER$
Computer: DC1
Description:
Object Open:
Object Server: DS
Object Type: configuration
Object Name: CN=Configuration,DC=MYDOMAIN,DC=com
New Handle ID: -
Operation ID: {0,91977835}
Process ID: 284
Primary User Name: DC1$
Primary Domain: MYDOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: RHMAIL$
Client Domain: MYDOMAIN
Client Logon ID: (0x0,0x57B785B)
Accesses Control Access

Privileges -

Properties:
READ_CONTROL
Create Child
Delete Child
List Contents
Write Self
Delete Tree
Manage Replication Topology






"In space, nobody can hear you click..."

 

[xmsre]

From the Exchange distribution CD, run policytest.exe. Hopefully this will shed some light on the issue for you.

XMSRE

 

[ReddLefty]

Will do, I'll post the results shortly.




"In space, nobody can hear you click..."

 

[ReddLefty]

Looks ok at first sight:

===============================================
Local domain is "mycompany.com" (mycompany)
Account is "mycompany\Exchange Enterprise Servers"
========================
DC = "DC1"
In site = "Default-First-Site-Name"
Right found: "SeSecurityPrivilege"
========================
DC = "DC3"
In site = "Default-First-Site-Name"
Right found: "SeSecurityPrivilege"

any other ideas? Any more tools on there that could check the assigned rights?



"In space, nobody can hear you click..."