Auditing object access fill security log with EventID 562 for Exchange

Discussion in 'Windows Small Business Server' started by Matt Woodman, Feb 22, 2006.

  1. Matt Woodman

    Matt Woodman Guest

    Hi

    I need to enable audit of object access in order to monitor users moving or
    deleting shared files/folders.

    When I set this in Group Policy the server security log is filled with
    entries for Exchange:-

    Event Type: Success Audit
    Event Source: Security
    Event Category: Object Access
    Event ID: 562
    Date: 22/02/2006
    Time: 12:32:25
    User: NT AUTHORITY\SYSTEM
    Computer: WS02SERVER
    Description:
    Handle Closed:
    Object Server: Microsoft Exchange
    Handle ID: 17691120
    Process ID: 4480
    Image File Name: C:\Program Files\Exchsrvr\bin\store.exe


    For more information, see Help and Support Center at
    http://go.microsoft.com/fwlink/events.asp.

    These entries appear every couple of seconds, which means that the log
    rapidly fills up.

    Is there any way I can stop these events from being recorded?

    Thanks

    Matt Woodman
     
    Matt Woodman, Feb 22, 2006
    #1
    1. Advertisements

  2. I increased the log file size :)
     
    Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP], Feb 22, 2006
    #2
    1. Advertisements

  3. Matt Woodman

    Matt Woodman Guest

    Thanks Susan

    Out of interest, what file size did you settle on - mine is currently 64MB
    with +190,000 entries.

    Thanks again.

    Matt
     
    Matt Woodman, Feb 23, 2006
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.