Windows Forum

Ask something
Discussion Locked

Failure Audit - Event ID 565

0 helpful
11 replies

by egowen

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
We have a mixed-node W2K-NT domain. There are two W2k domain controllers and two older NT4 BDCs. We also have several W2K member servers one of which is generating Failure Audit - Security - Directory Service Access Event ID 565 for the manchines account (WEB2K$). I can't find any usable information on what this Event ID means or how to handle it. All systems are up and running with out any percieved problem but the security event log on the W2K Domain Controller acting as PDC is full of 565 events

11 replies

by shanghai sam

I am aware that 565 is normally a success audit. This is part of what troubles me. I have a Failure Audit Event Code 565 being generated against the computer account ($) on only one Windows 2000 Server in my mixed-mode domain.

by estebandelatorre

The security audit was not completed due to the loss of a connection, invalid user id sor something else invalid.
Any event that is not a "success event" like a good authentication, is registered as incomplete, due to the fact that you can't track (one or many) down where it cames, how made that, when, what mac address, etc, etc.
That's Microsoft!, it works that way...

by egowen

The 565 events reoccur multiple times each day in clusters. There is no indication of an authentication problem. The Web Server does not lose connectivity with the domain controllers. I now have a W2K Pro (with IIS loaded) that is generating the same 565 type errors. These errors seem to be related to running IIS on a non-domain controller. The Laptop with W2K Pro did not start generating the 565 error until after IIS was installed.

by maxwell edison

Once you’ve enabled auditing, event ID No. 565 entries will appear in the security log. Unfortunately, this event is for all directory service operations (object creation, deletion, modification, and the like). ACL changes will be indicated inthe “Accesses” section with the WRITE_DAC keyword. Ownership changes will be indicated with a WRITE_OWNER keyword.

As Figure 5 shows, the audit logs tell you who did the action, where the action was applied, and when it happened. Butit won’t tell you what kind of access was changed or whose access changed.

See this link for "figure 5" and the whole article explaining that.

http://www.mcpmag.com/Features/article.asp?EditorialsID=233

Also see:

http://searchwin2000.techtarget.com/tip/1,289483,sid1_gci773702,00.html?FromTaxonomy=%2Fpr%2F5e3

http://www.jsiinc.com/SUBI/tip4100/rh4108.htm

(REMOVE SPACES from the pasted URL.)

Maxwell

This discussion is closed to new replies.