Auditing object access fill security log with EventID 562 for Exchange

Discussion in 'Windows Small Business Server' started by Matt Woodman, Feb 22, 2006.

  1. Matt Woodman

    Matt Woodman Guest


    I need to enable audit of object access in order to monitor users moving or
    deleting shared files/folders.

    When I set this in Group Policy the server security log is filled with
    entries for Exchange:-

    Event Type: Success Audit
    Event Source: Security
    Event Category: Object Access
    Event ID: 562
    Date: 22/02/2006
    Time: 12:32:25
    Computer: WS02SERVER
    Handle Closed:
    Object Server: Microsoft Exchange
    Handle ID: 17691120
    Process ID: 4480
    Image File Name: C:\Program Files\Exchsrvr\bin\store.exe

    For more information, see Help and Support Center at

    These entries appear every couple of seconds, which means that the log
    rapidly fills up.

    Is there any way I can stop these events from being recorded?


    Matt Woodman
    Matt Woodman, Feb 22, 2006
    1. Advertisements

  2. I increased the log file size :)
    Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP], Feb 22, 2006
    1. Advertisements

  3. Matt Woodman

    Matt Woodman Guest

    Thanks Susan

    Out of interest, what file size did you settle on - mine is currently 64MB
    with +190,000 entries.

    Thanks again.

    Matt Woodman, Feb 23, 2006
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.