Windows2003 R2 SP2 File Auditing Bug

[Andreas Wahlert]

Hi List


after turning on the File Auditing function on my Windows File Server
Cluster i get Failure Audit Entrys (EventID 560) in the Security Eventlog:

Object Open:
Object Server: Security
Object Type: File
Object Name:
\Device\HarddiskVolume5\Filespace\Service\Peng_Blubber.xls
Handle ID: -
Operation ID: {2,1322161015}
Process ID: 4
Image File Name: Primary User Name: Server01$
Primary Domain: HIPPO
Primary Logon ID: (0x0,0x3E7)
Client User Name: ichA
Client Domain: HIPPO
Client Logon ID: (0x2,0x4EC0A003)
Accesses: DELETE
READ_CONTROL
ACCESS_SYS_SEC
ReadData (or ListDirectory)
ReadEA
ReadAttributes
Privileges: -
Restricted Sid Count: 0
Access Mask: 0x1030089

This Entry occours only if the user wants to save an Office 2003
Document (doc or xls). The User has Change Rights on this share.
There is no difference with Office2003 SP1, SP2 or SP3

If the User save an Office Mac2008 Document, no error entry is logged.
Same when the User saves any other document (i.e. txt with notepad).

I have checked this behavior on three different Domains, with or without
an cluster environment.

Can anyone help me with this issue??

kind regards from vienna

Andreas