Good Afternnon,
I'm about at wits end with an issue I am having with 3 computers in my lab. These 3 machines are running Windows XP Service Pack 3. They are hooked up via a Network Switch and are using standard file sharing. There is no Domain Controller. I have enabled auditing for all object access failures for certain folders. Specifically, Windows\system32, Windows\Repair, and Windows\System.
I have allowed "Read" only from these folders, however, I am receiving numerous 560 Object Access Failure Audits labeled as SC_Manager, services.exe. I know the users are not purposefully attempting to write to the restricted files, and it must be a Windows function, but it is becoming tiresome sorting through hundreds of Failed Audits each week, which are erroneous.
On my other machines that I have in the lab, they are running Service Pack 2, and I have since installed a Hotfix for the specific problem, located in KB Article http://support.microsoft.com/kb/910720/ . However, I cannot install this Hotfix on the Service Pack 3 machines, because it was supposedly fixed in the SP3 deployment package. It obviously was not.
Any assistance is greatly appreciated. I do need to add though, a couple of caveats. I cannot turn Auditing off and I cannot change the auditing permissions of the specific System Files.
Thank you.
I'm about at wits end with an issue I am having with 3 computers in my lab. These 3 machines are running Windows XP Service Pack 3. They are hooked up via a Network Switch and are using standard file sharing. There is no Domain Controller. I have enabled auditing for all object access failures for certain folders. Specifically, Windows\system32, Windows\Repair, and Windows\System.
I have allowed "Read" only from these folders, however, I am receiving numerous 560 Object Access Failure Audits labeled as SC_Manager, services.exe. I know the users are not purposefully attempting to write to the restricted files, and it must be a Windows function, but it is becoming tiresome sorting through hundreds of Failed Audits each week, which are erroneous.
On my other machines that I have in the lab, they are running Service Pack 2, and I have since installed a Hotfix for the specific problem, located in KB Article http://support.microsoft.com/kb/910720/ . However, I cannot install this Hotfix on the Service Pack 3 machines, because it was supposedly fixed in the SP3 deployment package. It obviously was not.
Any assistance is greatly appreciated. I do need to add though, a couple of caveats. I cannot turn Auditing off and I cannot change the auditing permissions of the specific System Files.
Thank you.
