GFI ESM GFI ESM

Event ID: Event Source:

Event ID 560 Source security

Event ID560
SourceSecurity
TypeFailure Audit
DescriptionObject Open:
    Object Server: Security
    Object Type: File
Object Name: C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\786999f5617b331428135848d30802a1_95722ae1-5c2c-44ed-b461-2ffde378ef2f
    New Handle ID: -
    Operation ID: {0,1378043}
    Process ID: 848
    Primary User Name: SERVER$
    Primary Domain: @HOMENETWORK
    Primary Logon ID: (0x0,0x3E7)
Client User Name: Administrator
    Client Domain: SERVER
    Client Logon ID: (0x0,0xE816)
    Accesses READ_CONTROL
        SYNCHRONIZE
        WriteData (or AddFile)
        AppendData (or AddSubdirectory or CreatePipeInstance)
        WriteEA
        ReadAttributes
        WriteAttributes

Privileges
Comments and links for event id 560 from source Security
 
Event ID560
SourceSecurity
TypeSuccess Audit
DescriptionObject Open:
Object Server: Security
Object Type: <keye>
Object Name: \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Eventlog\Security
Handle ID: <ID>
Operation ID: {0,112580708}
Process ID: <PID>
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: <username>
Primary Domain: <domain name>
Primary Logon ID: (0x0,0x3E7)
Client User Name: <username>
Client Domain: <domain name>
Client Logon ID: (0x0,0x3E7)
Accesses: Set key value
Privileges: -
Restricted Sid Count: 0
Comments and links for event id 560 from source Security
 
Contribute
If you have details about an event with id 560 that is not listed in our database, please, send it to us. The submitted event will be forwarded to our consultants for analysis. We recommend you to check the EventID.Net Processing Queue to see if the event was already been submitted by another contributor.