|
|
|
date: Sat, 12 Apr 2008 11:11:01 -0700,
group: microsoft.public.exchange.misc
back
Event 565 in Security Log
Hi,
We recently replaced our Win2K SBS server with a Win2003 R2 SBS Premium
server. Ever since we a lot of Event 565âs in our Security Log (see below)
which we never got on our Win2K server. Our users are not seeing any errors
on their end.
Weâre using Exchange 2003 (with all the latest SPâs & updates) and Outlook
2003 (with all the latest SPâs & updates). This server is our only server so
itâs the DC, Exchange server, IIS server, ISA server, etc.
Any help would be greatly appreciated. Iâm posting this in multiple
discussion groups.
Thanks,
James
<Event_565>
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 4/12/2008
Time: 1:52:36 PM
User: DOMAIN-NAME\jamesb
Computer: our-server
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Logon
Object Name: /o=DOMAIN-NAME/ou=first administrative
group/cn=Recipients/cn=jamesb
Handle ID: -
Operation ID: {0,22229821}
Process ID: 5432
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: our-server$
Primary Domain: DOMAIN-NAME
Primary Logon ID: (0x0,0x3E7)
Client User Name: jamesb
Client Domain: DOMAIN-NAME
Client Logon ID: (0x0,0x15332E5)
Accesses: Unknown specific access (bit 8)
Privileges: -
Properties:
---
Send As
user
Access Mask: 0
date: Sat, 12 Apr 2008 11:11:01 -0700
author: James B
Re: Event 565 in Security Log
What is jamesb trying to do at the time the audit is logged? my guess would
be access another mailbox folder without the required permissions.
In 2000, domain admins could access any mailbox. In 2003 (and I forget the
specific SP for 2000) they are explicitly denied send as and receive as
permissions.
"James B" wrote in message
news:F6900232-5253-45FB-8A73-AA76539AA1A4@microsoft.com...
> Hi,
> We recently replaced our Win2K SBS server with a Win2003 R2 SBS Premium
> server. Ever since we a lot of Event 565's in our Security Log (see below)
> which we never got on our Win2K server. Our users are not seeing any
> errors
> on their end.
>
> We're using Exchange 2003 (with all the latest SP's & updates) and
> Outlook
> 2003 (with all the latest SP's & updates). This server is our only server
> so
> it's the DC, Exchange server, IIS server, ISA server, etc.
>
> Any help would be greatly appreciated. I'm posting this in multiple
> discussion groups.
>
> Thanks,
> James
>
> <Event_565>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Object Access
> Event ID: 565
> Date: 4/12/2008
> Time: 1:52:36 PM
> User: DOMAIN-NAME\jamesb
> Computer: our-server
> Description:
> Object Open:
> Object Server: Microsoft Exchange
> Object Type: Microsoft Exchange Logon
> Object Name: /o=DOMAIN-NAME/ou=first administrative
> group/cn=Recipients/cn=jamesb
> Handle ID: -
> Operation ID: {0,22229821}
> Process ID: 5432
> Process Name: C:\Program Files\Exchsrvr\bin\store.exe
> Primary User Name: our-server$
> Primary Domain: DOMAIN-NAME
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: jamesb
> Client Domain: DOMAIN-NAME
> Client Logon ID: (0x0,0x15332E5)
> Accesses: Unknown specific access (bit 8)
>
> Privileges: -
>
> Properties:
> ---
> Send As
> user
>
> Access Mask: 0
date: Mon, 14 Apr 2008 00:37:08 -0700
author: John Fullbright fjohn@donotspamnetappdotcom
Re: Event 565 in Security Log
John,
Thanks for the reply. I am âjamesbâ and I was only reading my e-mail. I do
not access any other mailboxes other than my own. This error happens for most
(and probably all) of our users even though 90% of them do not access other
mailboxes.
I do have access to a shared calendar, though I wasn't accessing any
calendar at the time of the errors.
Thanks,
James
"John Fullbright" wrote:
> What is jamesb trying to do at the time the audit is logged? my guess would
> be access another mailbox folder without the required permissions.
>
> In 2000, domain admins could access any mailbox. In 2003 (and I forget the
> specific SP for 2000) they are explicitly denied send as and receive as
> permissions.
>
>
>
>
> "James B" wrote in message
> news:F6900232-5253-45FB-8A73-AA76539AA1A4@microsoft.com...
> > Hi,
> > We recently replaced our Win2K SBS server with a Win2003 R2 SBS Premium
> > server. Ever since we a lot of Event 565's in our Security Log (see below)
> > which we never got on our Win2K server. Our users are not seeing any
> > errors
> > on their end.
> >
> > We're using Exchange 2003 (with all the latest SP's & updates) and
> > Outlook
> > 2003 (with all the latest SP's & updates). This server is our only server
> > so
> > it's the DC, Exchange server, IIS server, ISA server, etc.
> >
> > Any help would be greatly appreciated. I'm posting this in multiple
> > discussion groups.
> >
> > Thanks,
> > James
> >
> > <Event_565>
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Object Access
> > Event ID: 565
> > Date: 4/12/2008
> > Time: 1:52:36 PM
> > User: DOMAIN-NAME\jamesb
> > Computer: our-server
> > Description:
> > Object Open:
> > Object Server: Microsoft Exchange
> > Object Type: Microsoft Exchange Logon
> > Object Name: /o=DOMAIN-NAME/ou=first administrative
> > group/cn=Recipients/cn=jamesb
> > Handle ID: -
> > Operation ID: {0,22229821}
> > Process ID: 5432
> > Process Name: C:\Program Files\Exchsrvr\bin\store.exe
> > Primary User Name: our-server$
> > Primary Domain: DOMAIN-NAME
> > Primary Logon ID: (0x0,0x3E7)
> > Client User Name: jamesb
> > Client Domain: DOMAIN-NAME
> > Client Logon ID: (0x0,0x15332E5)
> > Accesses: Unknown specific access (bit 8)
> >
> > Privileges: -
> >
> > Properties:
> > ---
> > Send As
> > user
> >
> > Access Mask: 0
>
>
>
date: Tue, 15 Apr 2008 03:24:01 -0700
author: James B
|
|
