|Subject:||Multiple 562/565 Events|
|Date:||Wed, 30 Sep 2009|
we are seeing multipe 562/565 events, mostly as pairs, for a couple of
machines on our Windows 2003 domain at a rate of around 3000 per minute.
Part of 562;
Object Server: Security Account Manager
Handle ID: 113019808
Process ID: 512
Image File Name: C:\WINDOWS\system32\lsass.exe
Process 512 does not show up in the list of processes viewed via Task
Manager on the workstation.
User: in both events is domain\machinename$.
How would I go about finding which Directory Service Access (565) or Object
Access (562) these refer to or troubleshooting please as this is not typical
behaviour on our network?