565 Failure Security Log

[michaelfaulkner]

Exchange 2003/SP1. I'm seeing success audit then an immediate failure on properties in store.exe (private MDB) for all of my users when they logon. For example:

**************************************************

Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /o=xxxxxx/ou=xxxxx Exchange/cn=Configuration/cn=Servers/cn=xxxx/cn=Microsoft Private MDB
Handle ID: 0
Operation ID: {0,4614696}
Process ID: 3204
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: SERVER$
Primary Domain: AD
Primary Logon ID: (0x0,0x3E7)
Client User Name: JoeBlow
Client Domain: AD
Client Logon ID: (0x0,0x466A09)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 4)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
%{d74a876f-22b9-11d3-aa62-00c04f8eedd8}
DELETE
WRITE_DAC
WRITE_OWNER
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 6)
%{d74a875e-22b9-11d3-aa62-00c04f8eedd8}
DELETE
READ_CONTROL
SYNCHRONIZE
Unknown specific access (bit 0)
Unknown specific access (bit 1)
Unknown specific access (bit 6)
%{cffe6da4-afe6-11d2-aa04-00c04f8eedd8}

 

[neoadmin]

I'm also having the exact same issue as michaelfaulkner and am yet to find a solution. We're running Exchange 2003 SP1 on a Windows Server 2003 box, all fixes applied.

Anyone have any ideas on this? - got me stumped..

 

[michaelfaulkner]

NeoAdmin: Microsoft quoted this KB article when I called them. Not sure if it is relevant, but I'd like to test setting delegation access and see if the same error is created.

The reason for this error is due to:
1 You access another user's mailbox by using delegate access.

2. Audit logging is turned on for object access -You can safely ignore the failure audit events.

KB:813229 XADM: Failure Audit Security Event ID Messages Are Logged