Explorer Erroneously Generates Event 560 - Write Failures (172509)
The information in this article applies to:
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Server 4.0
This article was previously published under Q172509 SYMPTOMS
When you use Explorer to view directories and files, a Security Audit
Failure Event 560 may be generated. A typical Security Event might be:
8/5/97 8:11:45 PM Security Failure Audit
Object Access 560
<USERNAME>
<MACHINE NAME>
Object Open:
Object Server: Security
Object Type: File
Object Name: <FILE PATH\NAME>
New Handle ID: -
Operation ID: {0,195446}
Process ID: 2156888096
Primary User Name: <USERNAME>
Primary Domain: <DOMAIN NAME>
Primary Logon ID: (0x0,0x2EA46)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses SYNCHRONIZE
ReadAttributes
WriteAttributes
CAUSE
The local user having only Read and Execute (RX) Permissions may cause
this when the files are being audited for Write failures.
WORKAROUND
To work around this problem:
- Use File Manager instead of Explorer and these errors will not be
generated.
- Do not audit write failures on files that only have Read and Execute
access.
STATUS
Microsoft has confirmed this to be a problem in Windows NT version 4.0 We
are researching this problem and will post new information here in the
Microsoft Knowledge Base as it becomes available.
| Modification Type: | Major | Last Reviewed: | 8/9/2001 |
|---|
| Keywords: | KB172509 |
|---|
|