General discussion


Windows XP security event 560

By dharwell ·
I am currently attempting to update several system to meet government NISPOM specifications. These are clone and rack mount PC's running Windows XP Pro. There are specific files that are restricted from acess, and these files, when changes are attempted, should generated a 560 security event in the event viewer. The issue is that none of the systems involved will record this event! Microsoft unfortunately has been no help to this point.

This conversation is currently closed to new comments.

Thread display: Collapse - | Expand +

All Comments

Collapse -

Are these part of a domain or stand-alone? Has the policy for "Audit object access" been set to failure?

Collapse -

by allthegoodnamesweregone In reply to

actually, i think the auditing has to be enabled in the policy and on the objects as well. from security settings on C drive, go to advanced and the auditing tab. add the Users group, select the level of auditing you want, and set the replace auditing entriest on all child objects with entries shown here that apply to child objects checkbox.

Collapse -

by dharwell In reply to Windows XP security event ...

These are stand-alone machines, and yes, the audit for failure has been enabled.

Collapse -

by sgt_shultz In reply to Windows XP security event ...

what events *are* you getting?
562 567?
i wonder exactly what the spec is that you are trying to meet. i mean, what is the exact wording

Related Discussions

Related Forums