Failure audit, Event ID 560

Mr V

unread,

Aug 7, 2006, 7:17:02 AM8/7/06

to

Hello,
For some day's I have this error about 20 times à day in my security
eventlog :

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 31/07/2006
Time: 8:26:10
User: NT AUTHORITY\NETWORK SERVICE
Computer: SERVER
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: WinHttpAutoProxySvc
Handle ID: -
Operation ID: {0,66936345}
Process ID: 672
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: SERVER$
Primary Domain: DOMAIN
Primary Logon ID: (0x0,0x3E7)
Client User Name: NETWORK SERVICE
Client Domain: NT AUTHORITY
Client Logon ID: (0x0,0x3E4)
Accesses: Query status of service
Start the service
Query information from service

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x94

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

I checked the application log and there is no application information or
erros on the same moment as the audit failure.
Does anyone have any idea on how to fix this failures?
thanks
Koen Verlinde

bass_player

unread,

Aug 7, 2006, 7:46:01 AM8/7/06

to

Have you checked this out?
http://support.microsoft.com/?id=841001

It may work for Windows SBS 2003
--
MCP MCDBA MCAD MCSD MCT MCTS:SQL Server 2005
"Helping people grow and develop their full potential as God has plan for
them"

Crina Li

unread,

Aug 8, 2006, 2:10:43 AM8/8/06

to

Hi Koen,

Thank you for posting in the SBS Newsgroup.

From the description, I understand that you received some 560 failure audit
security events from the server. This is an expected behavior and it will
not cause real problem. Regarding this behavior, please refer to my
comments below:

The event occurs when 'Object Access' audit option is enabled in the group
policy. I enabled the audit option and also see the event from my SBS box.
Based on my further research, I noticed that the event could be logged when
the users attempted to access the Companyweb site. Restart the IIS service
(run iisreset) and then access the Companyweb site. You may see the event
from the security log.

The event indicated that the NETWORK SERVICE account attempted to start the
WinHttpAutoProxySvc service. Since the NETWORK SERVICE does not have the
permission on operating the particular service, the failure audit event
would be logged. The service startup request seems to be initiated by the
SharePoint component. Referring to our internal documents, this appears to
be a code design of the SharePoint services.

For the WinHttpAutoProxySvc service, only the SYSTEM account has the full
control permission. Also, the service is logged on with the SYSTEM account.
On a normal SBS server, the service startup type of the service is
configured as 'Manual'. If you do not want to use the web proxy automatic
discovery feature, the service should not be stopped. Even the NETWORK
SERVICE account submits the service start request; the WinHttpAutoProxySvc
would not be started unexpectedly due to the permission control.

More info:

829623 Default Services That Are Installed in Windows Small Business Server
2003
http://support.microsoft.com/?id=829623

Basically, this is a normal by designed behavior for SBS 2003 server. It
will not cause problem to the server operation.

I hope the above information helps.

I appreciate your time and look forward to hearing from you.

Best regards,

Crina Li (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.

=====================================================