Hey does anybody out there recognize these events in Event Viewer Security log? Or am I being overly paranoid and what I’m looking at is the system itself accessing objects?
Event Type: Success Audit
Event Source: Security
Event Category: ObjectAccess
Event ID: 560
Date: 5/18/2002
Time: 1:38:00 AM
User: NT AUTHORITY\SYSTEM
Computer: WHITESTAR
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name:
New Handle ID: 340
Operation ID: {0,600671}
Process ID: 804
Primary User Name: WHITESTAR$
Primary Domain: PROTECH
Primary Logon ID: (0x0,0x3E7)
Client User Name: –
Client Domain: –
Client Logon ID: –
Accesses DELETE
READ_CONTROL
WRITE_DAC
WRITE_OWNER
SYNCHRONIZE
ReadData (or ListDirectory)
WriteData (or AddFile)
AppendData (or AddSubdirectory or CreatePipeInstance)
ReadEA
WriteEA
Execute/Traverse
DeleteChild
ReadAttributes
WriteAttributesPrivileges –