Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Getting alot of these on one of the DCs security log:

*Event Type: Failure Audit
Event Source: Security
Event Category: Directory Service Access
Event ID: 566
Date: 27/01/2010
Time: 10:12:41
User: Domain\Exchangeserver$
Computer: DC
Description:
Object Operation: Object Server: DS
Operation Type: Object Access
Object Type: container
Object Name: CN=Deleted Objects,CN=Configuration,DC=Domain,DC=local
Handle ID: -
Primary User Name: DC$
Primary Domain: Domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: Exchangeserver$
Client Domain: Domain
Client Logon ID: (0x0,0x55A0BA34)
Accesses: Read Property

Properties:


Default property set
uSNChanged
Public Information
objectClass
container
Additional Info:
Additional Info2:
Access Mask: 0x10*

The only thing I've noticed is there are some plain SIDs showing in mailbox rights (ADUC) for some of our users which I can only assume are old users accounts that have now been deleted (Sid to user will not resolve). Not sure if it's related.

Any ideas?

Thanks

share|improve this question
add comment

1 Answer 1

up vote 1 down vote accepted

Based on some Googling after I encountered this, I found that there was a change in Windows 2003 that allowed attributes to be marked as confidential. I’m not sure if this applied to “uSNChanged.”

One example result (a top Google hit):

http://www.eventid.net/display.asp?eventid=566&eventno=4015&source=Security&phase=1

Assuming this applies to your situation, you appear to have two options (quoted from the article linked above):

  1. Set Directory Service Access Auditing to no auditing to remove the audit entries from the security event log.
  2. In ADSIEDIT go into the SCHEMA partition - UnixUserPassword - under the attributes of search flags change from 128 to 0 then Force replication.

I didn’t come across anything obviously more specific when looking for “event id 566” along with “uSNChanged.” Adapt the instructions for the attributes in your situation.

There are lots of mentions of this elsewhere. I haven’t sorted it out myself, but hopefully this helps your situation.

share|improve this answer
    
I did stumble across something similar and ended up disabling the auditing for directory server access. I don't believe Google was that helpful at the time! –  Ethos Jan 19 '11 at 21:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.