On a Windows 2000 Web server, I receive a persistent error everytime task manager or any other program is run while logged on locally as the administrator. Exact error is a Failure Audit in the Security log showing an Event ID 560 every second. itis filling up the Security log and I would like to prevent it from logging a 560 error for this reason but continue to log them for other security purposes. Does anybody know how I can accomplish this? Event Type: Failure Audit Event Source: Security Event Category: Object Access Event ID: 560 Date: 12/15/2005 Time: 2:51:18 PM User: administrator Computer: SULU Description: Object Open: Object Server: Security Object Type: Desktop Object Name: \Winlogon New Handle ID: - Operation ID: {0,102157003} Process ID: 3344 Primary User Name: administrator Primary Domain: UOWEB Primary Logon ID: (0x0,0x1730C4A) Client User Name: - Client Domain: - Client Logon ID: - Accesses MAX_ALLOWED Read Objects Write objects Privileges -

Windows logs event ID 560 when you enable system-level file and object auditing without enabling object-level auditing. Is this what's going on? Internet search engines are your friends. Morpheus: There is a difference between knowing the path and walking the path. "The Matrix"