Hi,
I have noticed that my security event log is filling up with the following events:
Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,436217805}
Process ID: 612
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: SERVERNAME$
Primary Domain: DOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: USERNAME
Client Domain: DOMAIN
Client Logon ID: (0x0,0x1A0027BE)
Accesses: READ_CONTROL
Connect to service controller
Enumerate services
Query service database lock state
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x20015
This event is only happening on Windows 2003 servers (all have SP1 installed), and this only seems to happen for two users when they connect to a SQL 2000 using Enterprise Manager of Query Analyser.
The two users do not have local administrator rights, however they do have SQL System Administrator rights.
The servers are members of a Active Directory domain, and Group Polices are configured to audit Object Access failure for the whole domain.
Cheers
P
I have noticed that my security event log is filling up with the following events:
Object Open:
Object Server: SC Manager
Object Type: SC_MANAGER OBJECT
Object Name: ServicesActive
Handle ID: -
Operation ID: {0,436217805}
Process ID: 612
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: SERVERNAME$
Primary Domain: DOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: USERNAME
Client Domain: DOMAIN
Client Logon ID: (0x0,0x1A0027BE)
Accesses: READ_CONTROL
Connect to service controller
Enumerate services
Query service database lock state
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x20015
This event is only happening on Windows 2003 servers (all have SP1 installed), and this only seems to happen for two users when they connect to a SQL 2000 using Enterprise Manager of Query Analyser.
The two users do not have local administrator rights, however they do have SQL System Administrator rights.
The servers are members of a Active Directory domain, and Group Polices are configured to audit Object Access failure for the whole domain.
Cheers
P
