Event 565 in Security Log

[James B]

Hi,
We recently replaced our Win2K SBS server with a Win2003 R2 SBS Premium
server. Ever since we a lot of Event 565’s in our Security Log (see below)
which we never got on our Win2K server. Our users are not seeing any errors
on their end.

We’re using Exchange 2003 (with all the latest SP’s & updates) and Outlook
2003 (with all the latest SP’s & updates). This server is our only server so
it’s the DC, Exchange server, IIS server, ISA server, etc.

Any help would be greatly appreciated. I’m posting this in multiple
discussion groups.

Thanks,
James

<Event_565>
Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 4/12/2008
Time: 1:52:36 PM
User: DOMAIN-NAME\jamesb
Computer: our-server
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Logon
Object Name: /o=DOMAIN-NAME/ou=first administrative
group/cn=Recipients/cn=jamesb
Handle ID: -
Operation ID: {0,22229821}
Process ID: 5432
Process Name: C:\Program Files\Exchsrvr\bin\store.exe
Primary User Name: our-server$
Primary Domain: DOMAIN-NAME
Primary Logon ID: (0x0,0x3E7)
Client User Name: jamesb
Client Domain: DOMAIN-NAME
Client Logon ID: (0x0,0x15332E5)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
---
Send As
user

Access Mask: 0

 

[kj [SBS MVP]]

Re: Event 565 in Security Log

James B wrote:
> Hi,
> We recently replaced our Win2K SBS server with a Win2003 R2 SBS
> Premium server. Ever since we a lot of Event 565's in our Security
> Log (see below) which we never got on our Win2K server. Our users are
> not seeing any errors on their end.
>
> We're using Exchange 2003 (with all the latest SP's & updates) and
> Outlook 2003 (with all the latest SP's & updates). This server is our
> only server so it's the DC, Exchange server, IIS server, ISA server,d
> etc.
>
> Any help would be greatly appreciated. I'm posting this in multiple
> discussion groups.

Should be posted in microsoft.public.windows.server.sbs and crossposted when
appropriate never multiposted (as it appears you've done). I'm adding in the
sbs group for you.

So, *how* did you "replace" your SBS2k server with a 2003 SBS server? Please
describe your method.


>
> Thanks,
> James
>
> <Event_565>
> Event Type: Failure Audit
> Event Source: Security
> Event Category: Object Access
> Event ID: 565
> Date: 4/12/2008
> Time: 1:52:36 PM
> User: DOMAIN-NAME\jamesb
> Computer: our-server
> Description:
> Object Open:
> Object Server: Microsoft Exchange
> Object Type: Microsoft Exchange Logon
> Object Name: /o=DOMAIN-NAME/ou=first administrative
> group/cn=Recipients/cn=jamesb
> Handle ID: -
> Operation ID: {0,22229821}
> Process ID: 5432
> Process Name: C:\Program Files\Exchsrvr\bin\store.exe
> Primary User Name: our-server$
> Primary Domain: DOMAIN-NAME
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: jamesb
> Client Domain: DOMAIN-NAME
> Client Logon ID: (0x0,0x15332E5)
> Accesses: Unknown specific access (bit 8)
>
> Privileges: -
>
> Properties:
> ---
> Send As
> user
>
> Access Mask: 0

--
/kj

 

[James B]

Re: Event 565 in Security Log

KJ,
I sorry for the multiple postings, but I couldn't get the cross-posting to
work and I couldn't get to the SBS groups (it was a bad day all around).

We did a 'swing' migration onto a new server, which in hindsight didn't
really help us save much time or trouble.


Thanks,
James

"kj [SBS MVP]" wrote:

> James B wrote:
> > Hi,
> > We recently replaced our Win2K SBS server with a Win2003 R2 SBS
> > Premium server. Ever since we a lot of Event 565's in our Security
> > Log (see below) which we never got on our Win2K server. Our users are
> > not seeing any errors on their end.
> >
> > We're using Exchange 2003 (with all the latest SP's & updates) and
> > Outlook 2003 (with all the latest SP's & updates). This server is our
> > only server so it's the DC, Exchange server, IIS server, ISA server,d
> > etc.
> >
> > Any help would be greatly appreciated. I'm posting this in multiple
> > discussion groups.
>
> Should be posted in microsoft.public.windows.server.sbs and crossposted when
> appropriate never multiposted (as it appears you've done). I'm adding in the
> sbs group for you.
>
> So, *how* did you "replace" your SBS2k server with a 2003 SBS server? Please
> describe your method.
>
>
> >
> > Thanks,
> > James
> >
> > <Event_565>
> > Event Type: Failure Audit
> > Event Source: Security
> > Event Category: Object Access
> > Event ID: 565
> > Date: 4/12/2008
> > Time: 1:52:36 PM
> > User: DOMAIN-NAME\jamesb
> > Computer: our-server
> > Description:
> > Object Open:
> > Object Server: Microsoft Exchange
> > Object Type: Microsoft Exchange Logon
> > Object Name: /o=DOMAIN-NAME/ou=first administrative
> > group/cn=Recipients/cn=jamesb
> > Handle ID: -
> > Operation ID: {0,22229821}
> > Process ID: 5432
> > Process Name: C:\Program Files\Exchsrvr\bin\store.exe
> > Primary User Name: our-server$
> > Primary Domain: DOMAIN-NAME
> > Primary Logon ID: (0x0,0x3E7)
> > Client User Name: jamesb
> > Client Domain: DOMAIN-NAME
> > Client Logon ID: (0x0,0x15332E5)
> > Accesses: Unknown specific access (bit 8)
> >
> > Privileges: -
> >
> > Properties:
> > ---
> > Send As
> > user
> >
> > Access Mask: 0
>
> --
> /kj
>
>
>