Guest Eric Crumpton Posted October 4, 2007 Posted October 4, 2007 I get the following Security Event entry every few days. Same user and all every time. Does this indicate corruption in AD or is there some other explaination? Event Type: Failure Audit Event Source: Security Event Category: Directory Service Access Event ID: 566 Date: 10/4/2007 Time: 7:58:47 AM User: mydomain\computer1$ Computer: Domain Controller Description: Object Operation: Object Server: DS Operation Type: Object Access Object Type: dnsNode Object Name: DC=133,DC=10.168.192.in-addr.arpa,CN=MicrosoftDNS,CN=System,DC=mydomain,DC=local Handle ID: - Primary User Name: Domain Controller$ Primary Domain: mydomain Primary Logon ID: (0x0,0x3E7) Client User Name: computer1$ Client Domain: mydomain Client Logon ID: (0x0,0x554FE82) Accesses: Write Self Properties: --- Default property set dnsRecord dNSTombstoned dnsNode Additional Info: Additional Info2: Access Mask: 0x8 For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Guest ric926 Posted October 5, 2007 Posted October 5, 2007 RE: Event ID 566 what is it that the user is doing? is it local, across the net,web, any recent hard/software changes? something had to change for this to start. and if its not happening everyday then it could be a bad nic, cable, etc -- rf "Eric Crumpton" wrote: > I get the following Security Event entry every few days. Same user and all > every time. Does this indicate corruption in AD or is there some other > explaination? > > Event Type: Failure Audit > Event Source: Security > Event Category: Directory Service Access > Event ID: 566 > Date: 10/4/2007 > Time: 7:58:47 AM > User: mydomain\computer1$ > Computer: Domain Controller > Description: > Object Operation: > Object Server: DS > Operation Type: Object Access > Object Type: dnsNode > Object > Name: DC=133,DC=10.168.192.in-addr.arpa,CN=MicrosoftDNS,CN=System,DC=mydomain,DC=local > Handle ID: - > Primary User Name: Domain Controller$ > Primary Domain: mydomain > Primary Logon ID: (0x0,0x3E7) > Client User Name: computer1$ > Client Domain: mydomain > Client Logon ID: (0x0,0x554FE82) > Accesses: Write Self > > Properties: > --- > Default property set > dnsRecord > dNSTombstoned > dnsNode > > Additional Info: > Additional Info2: > Access Mask: 0x8 > > > For more information, see Help and Support Center at > http://go.microsoft.com/fwlink/events.asp. >
Recommended Posts