Windows2003 R2 SP2 File Auditing Bug

[Guest Andreas Wahlert]

Hi List

 

 

after turning on the File Auditing function on my Windows File Server

Cluster i get Failure Audit Entrys (EventID 560) in the Security Eventlog:

 

Object Open:

Object Server: Security

Object Type: File

Object Name:

\Device\HarddiskVolume5\Filespace\Service\Peng_Blubber.xls

Handle ID: -

Operation ID: {2,1322161015}

Process ID: 4

Image File Name: Primary User Name: Server01$

Primary Domain: HIPPO

Primary Logon ID: (0x0,0x3E7)

Client User Name: ichA

Client Domain: HIPPO

Client Logon ID: (0x2,0x4EC0A003)

Accesses: DELETE

READ_CONTROL

ACCESS_SYS_SEC

ReadData (or ListDirectory)

ReadEA

ReadAttributes

Privileges: -

Restricted Sid Count: 0

Access Mask: 0x1030089

 

This Entry occours only if the user wants to save an Office 2003

Document (doc or xls). The User has Change Rights on this share.

There is no difference with Office2003 SP1, SP2 or SP3

 

If the User save an Office Mac2008 Document, no error entry is logged.

Same when the User saves any other document (i.e. txt with notepad).

 

I have checked this behavior on three different Domains, with or without

an cluster environment.

 

Can anyone help me with this issue??

 

kind regards from vienna

 

Andreas