I need to learn more about an event in the Security Audit log

Here's an audit trail that we see.  I need to know more about this event and what it means.  This is a Windows 2003 server.

In particular:

-How do I determine who or what is: primary logon ID: (0x0, 0x3E7)

-How to determine what work or article is the GUID: C:\WINDOWS\Tasks\User_Feed_Synchronization-{F9ACF166-98DF-45BB-8F33-86CB4DD8A279}.job

Thank you.

Event type: Success Audit

Event source: security

Event category: object access

Event ID: 560

Date: 18/06/2011

Time: 22:14

User: NT AUTHORITY\SYSTEM

Computer: ABCWEBA04

Description:

Object open:

Object server: security

Object type: file

Object name: C:\WINDOWS\Tasks\User_Feed_Synchronization-{F9ACF166-98DF-45BB-8F33-86CB4DD8A279}.job

Manage IDS: 2828

Operation ID: {0,1576635}

Process ID: 876

Image file name: C:\WINDOWS\system32\svchost.exe

User principal name: ABCWEBA04$

Main domain: ABCRX

Primary login ID: (0x0, 0x3E7)

Client user name: -.

Client domain: -.

Customer login ID: -.

Access: READ_CONTROL

SYNCHRONIZE

WriteData (or AddFile)

AppendData (or add subdirectory or create instance of channel)

WriteEA

ReadAttributes

WriteAttributes

Privileges: -.

Restricted Sid Count: 0

Access mask: 0 x 120196

Hi Mike7211,

The question you posted would be better suited in the TechNet Forums, resources for computer scientists. Please visit the link below to repost your question:

http://social.technet.Microsoft.com/forums/en-us/category/WindowsServer

Thank you!

Tags: Windows

Similar Questions

Maybe you are looking for

  • MacBook randomly landed volume when the headphones are connected.

    Hey,. There is something wrong with my MacBook. When I plug my headphones, the Mac randomly landed the volume at any time. I thought the keyboard can be broken, but it doesn't happen when the headphones are connected so it may be a problem with the s

  • 15 - r231TX: will not turn on wifi

    What happens to it and how to activate the wireless network?

  • How to remove the Run-Time 8.5.0?

    I put in "Unable to install" "superior version already installed" error when I try to install a .exe. I see in the Max I have RunTime 8.5.0 installed and I'm using LV 8.2.1. How can I remove Run-Time 8.5.0? Thank you.

  • Microsoft Support person acting maybe in a weird way.

    I would like to re - install Windows 7 on my desktop.I tried to do this with my original Windows 7 Ultimate DVD, but it kept rejecting my original key. So I contacted Microsoft Support. They have created a ticket and I was contacted a week later sayi

  • Dealing with problem FileConnection class

    Hello guys I am experiencing problem dealing with FileConnection class. My app uses the class "javax.microedition.io.file.FileConnection". And when to start the application, the problem occurs that "Error starting ApplicationName class 'javax.microed