Multiple 562/565 Events

Giganews Newsgroups
Subject: Multiple 562/565 Events
Posted by:  swtmike
Date: Wed, 30 Sep 2009


we are seeing multipe 562/565 events, mostly as pairs, for a couple of
machines on our Windows 2003 domain at a rate of around 3000 per minute.

Part of 562;
Handle Closed:
        Object Server:        Security Account Manager
        Handle ID:        113019808
        Process ID:        512
        Image File Name:        C:\WINDOWS\system32\lsass.exe

Process 512 does not show up in the list of processes viewed via Task
Manager on the workstation.

User: in both events is domain\machinename$.

How would I go about finding which Directory Service Access (565) or Object
Access (562) these refer to or troubleshooting please as this is not typical
behaviour on our network?