Event Log ID 5145 - Detailed File Sharing

-

we have auditing turned on our server on 1 file in order determine computers accessing file.  have few computers accessing file (not workstations) though have no reason programmatically access files.  how  can determine why these workstations accessing file , disable it.  below sample:

- system
- provider
[ name] microsoft-windows-security-auditing
[ guid] {54849625-5478-4994-a5ba-3e3b0328c30d}
eventid 5145
version 0
level 0
task 12811
opcode 0
keywords 0x8020000000000000
- timecreated
[ systemtime] 2012-10-17t16:13:09.381066300z
eventrecordid 1038283
correlation
- execution
[ processid] 444
[ threadid] 460
channel security
computer sbistream.sheridanbooks.com
security
- eventdata
subjectusersid s-1-5-21-1993962763-1708537768-839522115-1357
subjectusername eblissic
subjectdomainname sbi
subjectlogonid 0x15329a4
objecttype file
ipaddress 10.2.40.59
ipport 64853
sharename \\*\stream
sharelocalpath \??\e:\stream
relativetargetname $extend\$quota:$q:$index_allocation
accessmask 0x12019f
accesslist %%1538 %%1541 %%4416 %%4417 %%4418 %%4419 %%4420 %%4423 %%4424
accessreason %%1538: %%1801 d:(a;;fa;;;wd) %%1541: %%1801 d:(a;;fa;;;wd) %%4416: %%1801 d:(a;;fa;;;wd) %%4417: %%1801 d:(a;;fa;;;wd) %%4418: %%1801 d:(a;;fa;;;wd) %%4419: %%1801 d:(a;;fa;;;wd) %%4420: %%1801 d:(a;;fa;;;wd) %%4423: %%1801 d:(a;;fa;;;wd) %%4424: %%1801 d:(a;;fa;;;wd)

this on client (workstation) side. use process monitor reveal problem causing process.

rgds

milos



Windows Server  >  Windows Server General Forum



Comments

Post a Comment

Popular posts from this blog

Generating Event ID 91, 44 with CA (In Event Viewer with source as Certsvc)

-
hi we in process of migrating win 2003 ad win2008 r2. when noticed logs found many errors , warning alerts ca below --could not connect active directory. certificate services retry when processing requires active directory access. (event id 91)----certificate services sagia ca can not open certificate store @ cn=ntauthcertificates,cn=public key services,cn=services in active directory's configuration container. (event id 94, warning)--                                                                                            ...
Read more

Group policy default policy cannot be edited because network name not found

-
hey everyone, i have been having issues on , off domain. pdc crashed (the domain controller). started old server , made domain controller , forced roles over. repaired pdc , elevated back. although appeared work found cannot rid of other dc because pdc can no longer contact domain things group policy or else. start secondary , domain magically reachable. although while secondary down can ping domain , replies ip of pdc appears pdc has no control on anything. questions following. 1. gpos created before crash no longer work. rebuilt sysvol , default problem can't edit default domain policy. don't believe having replication problems new repairing domains setting them , maintaining them of education came from.  2. if pdc gpo management console can't access gpos can secondary not have installed? 3. why domain unreachable if no dcs online when shutdown secondary. thanks in advance , try edit dc diag log right there on fails want narrow of out guys concentrate on...
Read more

Problem when changing update source

-
hi all, we use win server 2008 r2 enterprise , wsus 3.2. until last friday, downoloading updates microsoft's website. had change the source wsus server in our headquarters (not being replica server). started problem: our product , classification changed, downloading lot of updates hadn't ever downloaded. now, when try modify update soure (to microsoft's web site again) set option console falls down - database error - , copying error clipboard, have message bellow: the wsus administration console unable connect wsus server database.     verify sql server running on wsus server. if problem persists, try restarting sql.     system.data.sqlclient.sqlexception -- maximum stored procedure, function, trigger, or view nesting level exceeded (limit 32). info:spsetconfiguration - synctomu or upstreamservername config value changed - no reset source .net sqlclient data provider stack trace:    @ microsoft.updateservices.ui.admi...
Read more