Failure Audit for SQL Server

I am getting the below Failure Audit in the SQL Server event log for 3 users.
All the users have access to a database in SQL Server with their domain
account. Below message keeps poping every second. How can I trouble shoot
this ? What is causing it ?
Thanks.
----
Source: Security
Type: Failure
Event ID: 560
----
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: MSSQLSERVER
New Handle ID: -
Operation ID: {0,1170910191}
Process ID: 316
Primary User Name: DEVSERV1$
Primary Domain: CMR_PO
Primary Logon ID: (0x0,0x3E7)
Client User Name: aclint
Client Domain: CMR_PO
Client Logon ID: (0x0,0x3BAC59FE)
Accesses READ_CONTROL
Query service configuration information
Query status of service
Enumerate dependencies of service
Query information from service
Privileges -An event id 560 is just an open event. Check aclint's permission carefully.
Maybe ther is something he/she doesn't have access to like a particular proc
or table. Ask them if they see a message on their screen or if they are
experiencing any problems. see
http://www.microsoft.com/technet/archive/winntas/support/usesecur.mspx?mfr=true
for more info on security event logs
"DXC" wrote:
> I am getting the below Failure Audit in the SQL Server event log for 3 users.
> All the users have access to a database in SQL Server with their domain
> account. Below message keeps poping every second. How can I trouble shoot
> this ? What is causing it ?
> Thanks.
> ----
> Source: Security
> Type: Failure
> Event ID: 560
> ----
>
> Object Open:
> Object Server: SC Manager
> Object Type: SERVICE OBJECT
> Object Name: MSSQLSERVER
> New Handle ID: -
> Operation ID: {0,1170910191}
> Process ID: 316
> Primary User Name: DEVSERV1$
> Primary Domain: CMR_PO
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: aclint
> Client Domain: CMR_PO
> Client Logon ID: (0x0,0x3BAC59FE)
> Accesses READ_CONTROL
> Query service configuration information
> Query status of service
> Enumerate dependencies of service
> Query information from service
> Privileges -
>|||My guess is that this is either EM or Service Manager which tries to see whether the service is
running.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"Francis" <Francis@.discussions.microsoft.com> wrote in message
news:5844A73A-7208-480C-BDC8-8DDAADA4C86B@.microsoft.com...
> An event id 560 is just an open event. Check aclint's permission carefully.
> Maybe ther is something he/she doesn't have access to like a particular proc
> or table. Ask them if they see a message on their screen or if they are
> experiencing any problems. see
> http://www.microsoft.com/technet/archive/winntas/support/usesecur.mspx?mfr=true
> for more info on security event logs
> "DXC" wrote:
>> I am getting the below Failure Audit in the SQL Server event log for 3 users.
>> All the users have access to a database in SQL Server with their domain
>> account. Below message keeps poping every second. How can I trouble shoot
>> this ? What is causing it ?
>> Thanks.
>> ----
>> Source: Security
>> Type: Failure
>> Event ID: 560
>> ----
>>
>> Object Open:
>> Object Server: SC Manager
>> Object Type: SERVICE OBJECT
>> Object Name: MSSQLSERVER
>> New Handle ID: -
>> Operation ID: {0,1170910191}
>> Process ID: 316
>> Primary User Name: DEVSERV1$
>> Primary Domain: CMR_PO
>> Primary Logon ID: (0x0,0x3E7)
>> Client User Name: aclint
>> Client Domain: CMR_PO
>> Client Logon ID: (0x0,0x3BAC59FE)
>> Accesses READ_CONTROL
>> Query service configuration information
>> Query status of service
>> Enumerate dependencies of service
>> Query information from service
>> Privileges -|||Thanks for the replies but I will not pursue this any longer since I can not
get any info from our developers who are having this problem in terms of what
they are trying to run/access. It seems like there is no way to find out what
they are doing from my end. I don't see anything under "Current Activity"
window either.
Windows 2000, SQL Server 2000 SE-SP4
Thanks again.
"Tibor Karaszi" wrote:
> My guess is that this is either EM or Service Manager which tries to see whether the service is
> running.
> --
> Tibor Karaszi, SQL Server MVP
> http://www.karaszi.com/sqlserver/default.asp
> http://www.solidqualitylearning.com/
>
> "Francis" <Francis@.discussions.microsoft.com> wrote in message
> news:5844A73A-7208-480C-BDC8-8DDAADA4C86B@.microsoft.com...
> > An event id 560 is just an open event. Check aclint's permission carefully.
> > Maybe ther is something he/she doesn't have access to like a particular proc
> > or table. Ask them if they see a message on their screen or if they are
> > experiencing any problems. see
> > http://www.microsoft.com/technet/archive/winntas/support/usesecur.mspx?mfr=true
> > for more info on security event logs
> >
> > "DXC" wrote:
> >
> >> I am getting the below Failure Audit in the SQL Server event log for 3 users.
> >> All the users have access to a database in SQL Server with their domain
> >> account. Below message keeps poping every second. How can I trouble shoot
> >> this ? What is causing it ?
> >>
> >> Thanks.
> >> ----
> >> Source: Security
> >> Type: Failure
> >> Event ID: 560
> >> ----
> >>
> >>
> >> Object Open:
> >> Object Server: SC Manager
> >> Object Type: SERVICE OBJECT
> >> Object Name: MSSQLSERVER
> >> New Handle ID: -
> >> Operation ID: {0,1170910191}
> >> Process ID: 316
> >> Primary User Name: DEVSERV1$
> >> Primary Domain: CMR_PO
> >> Primary Logon ID: (0x0,0x3E7)
> >> Client User Name: aclint
> >> Client Domain: CMR_PO
> >> Client Logon ID: (0x0,0x3BAC59FE)
> >> Accesses READ_CONTROL
> >> Query service configuration information
> >> Query status of service
> >> Enumerate dependencies of service
> >> Query information from service
> >>
> >> Privileges -
> >>
>|||Again, it is probably EM checking whether the server is running. You can check this, by asking one
of the users to stop EM, see if these events stop, and start EM again.
Also, you can uncheck the option "Display server state in console" for the server registration in EM
and see if these events disappear.
--
Tibor Karaszi, SQL Server MVP
http://www.karaszi.com/sqlserver/default.asp
http://www.solidqualitylearning.com/
"DXC" <DXC@.discussions.microsoft.com> wrote in message
news:2C1753AF-910D-4F62-A781-5870EE0C702E@.microsoft.com...
> Thanks for the replies but I will not pursue this any longer since I can not
> get any info from our developers who are having this problem in terms of what
> they are trying to run/access. It seems like there is no way to find out what
> they are doing from my end. I don't see anything under "Current Activity"
> window either.
> Windows 2000, SQL Server 2000 SE-SP4
> Thanks again.
> "Tibor Karaszi" wrote:
>> My guess is that this is either EM or Service Manager which tries to see whether the service is
>> running.
>> --
>> Tibor Karaszi, SQL Server MVP
>> http://www.karaszi.com/sqlserver/default.asp
>> http://www.solidqualitylearning.com/
>>
>> "Francis" <Francis@.discussions.microsoft.com> wrote in message
>> news:5844A73A-7208-480C-BDC8-8DDAADA4C86B@.microsoft.com...
>> > An event id 560 is just an open event. Check aclint's permission carefully.
>> > Maybe ther is something he/she doesn't have access to like a particular proc
>> > or table. Ask them if they see a message on their screen or if they are
>> > experiencing any problems. see
>> > http://www.microsoft.com/technet/archive/winntas/support/usesecur.mspx?mfr=true
>> > for more info on security event logs
>> >
>> > "DXC" wrote:
>> >
>> >> I am getting the below Failure Audit in the SQL Server event log for 3 users.
>> >> All the users have access to a database in SQL Server with their domain
>> >> account. Below message keeps poping every second. How can I trouble shoot
>> >> this ? What is causing it ?
>> >>
>> >> Thanks.
>> >> ----
>> >> Source: Security
>> >> Type: Failure
>> >> Event ID: 560
>> >> ----
>> >>
>> >>
>> >> Object Open:
>> >> Object Server: SC Manager
>> >> Object Type: SERVICE OBJECT
>> >> Object Name: MSSQLSERVER
>> >> New Handle ID: -
>> >> Operation ID: {0,1170910191}
>> >> Process ID: 316
>> >> Primary User Name: DEVSERV1$
>> >> Primary Domain: CMR_PO
>> >> Primary Logon ID: (0x0,0x3E7)
>> >> Client User Name: aclint
>> >> Client Domain: CMR_PO
>> >> Client Logon ID: (0x0,0x3BAC59FE)
>> >> Accesses READ_CONTROL
>> >> Query service configuration information
>> >> Query status of service
>> >> Enumerate dependencies of service
>> >> Query information from service
>> >>
>> >> Privileges -
>> >>
>>|||In reference to SQL2000 at this site:
You may want to check if users are signed on to SQL Enterprise using
SQL logins and have 'Poll Server' checked
<Tools><Options>[Panel]General.
If this is checked, it will generate audit failures trying to
poll/acquire data using their domain account(s).
DXC wrote:
> I am getting the below Failure Audit in the SQL Server event log for 3 users.
> All the users have access to a database in SQL Server with their domain
> account. Below message keeps poping every second. How can I trouble shoot
> this ? What is causing it ?
> Thanks.
> ----
> Source: Security
> Type: Failure
> Event ID: 560
> ----
>
> Object Open:
> Object Server: SC Manager
> Object Type: SERVICE OBJECT
> Object Name: MSSQLSERVER
> New Handle ID: -
> Operation ID: {0,1170910191}
> Process ID: 316
> Primary User Name: DEVSERV1$
> Primary Domain: CMR_PO
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: aclint
> Client Domain: CMR_PO
> Client Logon ID: (0x0,0x3BAC59FE)
> Accesses READ_CONTROL
> Query service configuration information
> Query status of service
> Enumerate dependencies of service
> Query information from service
> Privileges -