| Subject: | Multiple 562/565 Events |
| Posted by: | swtmike |
| Date: | Wed, 30 Sep 2009 |
Hello,
we are seeing multipe 562/565 events, mostly as pairs, for a couple of
machines on our Windows 2003 domain at a rate of around 3000 per minute.
Part of 562;
Handle Closed:
Object Server: Security Account Manager
Handle ID: 113019808
Process ID: 512
Image File Name: C:\WINDOWS\system32\lsass.exe
Process 512 does not show up in the list of processes viewed via Task
Manager on the workstation.
User: in both events is domain\machinename$.
How would I go about finding which Directory Service Access (565) or Object
Access (562) these refer to or troubleshooting please as this is not typical
behaviour on our network?
Regards,
--
swtmike