2 Replies Latest reply on Jul 21, 2011 1:26 AM by bostjanc

    Event ID 560 makes security log full




      Users have mcafee agent 4.6 and Virusscan 8.8. Their security logs are being full. I have googled a little and found this workaround: https://kc.mcafee.com/corporate/index?page=content&id=KB51187&pmv=print but I think that is not acceptable solution. Any other solutions?


      Error message is:


      Event Type:  Failure Audit
      Event Source:         Security
      Event Category:      Object Access
      Event ID:      560
      Date:           16.7.2011
      Time:           13:18:33
      User:            NT AUTHORITY\SYSTEM
      Computer:     COMPUTER
      Object Open:
              Object Server:         SC Manager
              Object Type: SERVICE OBJECT
              Object Name: McShield
              Handle ID:     -
              Operation ID: {0,79667192}
              Process ID:    1104
              Image File Name:     C:\WINDOWS\system32\services.exe
              Primary User Name:  COMPUTER$
              Primary Domain:       DOMAIN
              Primary Logon ID:     (0x0,0x3E7)
              Client User Name:     COMPUTER$
              Client Domain:         DOMAIN
              Client Logon ID:       (0x0,0x3E7)
              Accesses:               Query status of service
                                  Pause or continue the service
                                  Issue service-specific control commands
               Privileges:               -
              Restricted Sid Count: 0

      For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.