Failure Audit errors on device name

6 Sep 2005 4:18 PM

srikash

Hi

I'm testing a vb.net console application that's kicked off by a
scheduled basis on hourly basis. I'm using Enterprise Library mainly
for Data access & logging. I have recompiled the source code leaving
out instrumentation functionality as it's creating quite a few security
violations.

The application functions fine except that we are seeing failure audit
messages in the security log. An example is below:

Event Type:    Failure Audit
Event Source:    Security
Event Category:    Object Access
Event ID:    560
Date:        9/06/2005
Time:        9:00:01 AM
User:        <Domain Name>\<Service Account Name>
Computer:    ITGSTOTMSD12
Description:
Object Open:
    Object Server:    Security
    Object Type:    File
    Object
Name:    \Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolume1\DotNet
    New Handle ID:    -
    Operation ID:    {0,179929514}
    Process ID:    3116
    Primary User Name:    <Service Account Name>
    Primary Domain:    <Domain Name>
    Primary Logon ID:    (0x0,0xAB962B6)
    Client User Name:    -
    Client Domain:    -
    Client Logon ID:    -
    Accesses        SYNCHRONIZE
            ReadData (or ListDirectory)

    Privileges        -

Can anyone tell what I am doing wrong here? I'm a developer and not an
administrator and so am not too familiar with the kind of permissions
that the service account needs other than the obvious ones.

thanks in advance
Srikash.

6 Sep 2005 4:57 PM

Dominick Baier [DevelopMentor]

Hello srikash,

seems the program tries to access a file and has not sufficient NTFS ACLs.

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote

> Hi
>
> I'm testing a vb.net console application that's kicked off by a
> scheduled basis on hourly basis. I'm using Enterprise Library mainly
> for Data access & logging. I have recompiled the source code leaving
> out instrumentation functionality as it's creating quite a few
> security violations.
>
> The application functions fine except that we are seeing failure audit
> messages in the security log. An example is below:
>
> Event Type:    Failure Audit
> Event Source:    Security
> Event Category:    Object Access
> Event ID:    560
> Date:        9/06/2005
> Time:        9:00:01 AM
> User:        <Domain Name>\<Service Account Name>
> Computer:    ITGSTOTMSD12
> Description:
> Object Open:
> Object Server:    Security
> Object Type:    File
> Object
> Name:    \Device\HarddiskDmVolumes\PhysicalDmVolumes\BlockVolume1\DotNet
> New Handle ID:    -
> Operation ID:    {0,179929514}
> Process ID:    3116
> Primary User Name:    <Service Account Name>
> Primary Domain:    <Domain Name>
> Primary Logon ID:    (0x0,0xAB962B6)
> Client User Name:    -
> Client Domain:    -
> Client Logon ID:    -
> Accesses        SYNCHRONIZE
> ReadData (or ListDirectory)
> Privileges        -
>
> Can anyone tell what I am doing wrong here? I'm a developer and not an
> administrator and so am not too familiar with the kind of permissions
> that the service account needs other than the obvious ones.
>
> thanks in advance
> Srikash.