Overload: 562/565 Security Events (Success Audit)

Discussion in 'Server Security' started by swtmike, Jul 16, 2009.

  1. swtmike

    swtmike Guest

    Hello,

    we are seeing multipe 562/565 events, mostly as pairs, for a couple of
    machines on our Windows 2003 domain at a rate of around 3000 per second.

    Part of 562;
    Handle Closed:
    Object Server: Security Account Manager
    Handle ID: 113019808
    Process ID: 512
    Image File Name: C:\WINDOWS\system32\lsass.exe

    Process 512 does not show up in the list of processes viewed via Task
    Manager on the workstation.

    User: in both events is domain\machinename$.

    How would I go about finding which Directory Service Access (565) or Object
    Access (562) these refer to or troubleshooting please as this is not typical
    behaviour on our network?

    Regards,
     
    swtmike, Jul 16, 2009
    #1
    1. Advertisements

  2. swtmike

    swtmike Guest

    That should be '3000 per minute'. Per second varies with a peak of around 270.
     
    swtmike, Jul 16, 2009
    #2
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.