-
Title
Windows Audit Failure Message Event Viewer Log -
Description
This error may appear from the SQL Agent when running SSIS packages. In addition, it causes the SSIS jobs to fail.
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 4/6/2009
Time: 10:41:37 AM
User: DOMAINNAMEUSERNAMESQLSVC
Computer: COMPUTERNAME
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: WinHttpAutoProxySvc
Handle ID: -
Operation ID: {0,287804122}
Process ID: 420
Image File Name: C:WINDOWSsystem32services.exe
Primary User Name: USERNAME
Primary Domain: DOMAINNAME
Primary Logon ID: (0x0,0x3E7)
Client User Name: USERNAME_SQLSVC
Client Domain: DOMAINNAME
Client Logon ID: (0x0,0x1101C455)
Accesses: Query status of service
Start the service
Query information from service
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x94 -
Cause
An event id 560 is just an open event. Check the user's permission carefully. There may be something he/she doesn't have access to like a particular proc or table. Is the message onscreen or is there a failing process? Does the issue occurs with a user with local admin right?
In SQL2000, SQL Enterprise | SQL logins if 'Poll Server' is checked <Tools><Options>[Panel]General, it will generate audit failures trying to poll/acquire data using their domain account(s)
Also, this issue may not be related to SQL server itself. It can occur on a machine with multiple NICs installed. -
Resolution
WORKAROUND:
1. Verify the users logging permissions for the domain, proc, database, service and tables.
2. Because the users are getting Object Access Failure when trying to access a server, you may want to use a third-party tool such as filemon/regmon (which can be downloaded from www.sysinternals.com) to monitor the "access denied" error.
3. If you have multiple NICs, you may wish to temporarily disable the unused ones for testing purposes. -
Additional Information
See: http://www.microsoft.com/technet/archive/winntas/support/usesecur.mspx?mfr=true
OR http://msdn.microsoft.com/en-us/library/cc280386.aspx for more info on security event logs