[mdaughtry]

I keep getting these security Failures on exchange with besadmin account and public folders. i think this started when MSFT patched exchange and you had to do the "SEND AS", "RECIEVE AS" fix for BES.


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 7/26/2007
Time: 3:29:03 PM
User: DOMAIN123\besadmin
Computer: MAILSVR
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /DC=com/DC=DOMAIN123/CN=Configuration/CN=Services/CN=Microsoft Exchange/CN=DOMAIN123/CN=Administrative Groups/CN=First Administrative Group/CN=Servers/CN=MAILSVR
Handle ID: 0
Operation ID: {0,2436195295}
Process ID: 6116
Process Name: D:\Program Files\Exchsrvr\BIN\store.exe
Primary User Name: MAILSVR$
Primary Domain: DOMAIN123
Primary Logon ID: (0x0,0x3E7)
Client User Name: besadmin
Client Domain: DOMAIN123
Client Logon ID: (0x0,0x8E9FFB45)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
DELETE
WRITE_OWNER
ACCESS_SYS_SEC
Unknown specific access (bit 5)
Unknown specific access (bit 13)
Unknown specific access (bit 14)
Unknown specific access (bit 15)
Modify public folder admin ACL
---
Modify public folder expiry
%{d74a8774-2289-11d3-aa62-00c04f8eedd8}
Mail-enable public folder
Modify public folder deleted item retention
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
Unknown specific access (bit 5)
Create top level public folder
Unknown specific access (bit 0)
Unknown specific access (bit 3)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
Unknown specific access (bit 7)
Unknown specific access (bit 8)
Unknown specific access (bit 9)
Administer information store
Unknown specific access (bit 13)
Modify public folder quotas
DELETE
WRITE_OWNER
Unknown specific access (bit 0)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
Modify public folder ACL
READ_CONTROL
WRITE_DAC
WRITE_OWNER
Unknown specific access (bit 0)
Unknown specific access (bit 1)
Unknown specific access (bit 2)
Unknown specific access (bit 3)
Unknown specific access (bit 5)
Unknown specific access (bit 6)
Modify public folder replica list

Access Mask: 0


For more information, see Help and Support Center at Events And Errors Message Center: Basic Search.



Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 565
Date: 7/26/2007
Time: 3:27:43 PM
User: DOMAIN123\besadmin
Computer: MAILSVR
Description:
Object Open:
Object Server: Microsoft Exchange
Object Type: Microsoft Exchange Database
Object Name: /DC=com/DC=DOMAIN123/CN=Configuration/CN=Services/CN=Microsoft Exchange/CN=DOMAIN123/CN=Administrative Groups/CN=First Administrative Group/CN=Servers/CN=MAILSVR
Handle ID: 0
Operation ID: {0,2436026309}
Process ID: 6116
Process Name: D:\Program Files\Exchsrvr\BIN\store.exe
Primary User Name: MAILSVR$
Primary Domain: DOMAIN123
Primary Logon ID: (0x0,0x3E7)
Client User Name: besadmin
Client Domain: DOMAIN123
Client Logon ID: (0x0,0x8E9FFB45)
Accesses: Unknown specific access (bit 8)

Privileges: -

Properties:
---
%{a8df74ba-c5ea-11d1-bbcb-0080c76670c0}
Administer information store
%{d74a8774-2289-11d3-aa62-00c04f8eedd8}
Mail-enable public folder
Modify public folder deleted item retention
Modify public folder admin ACL
Modify public folder quotas
Modify public folder replica list
Create top level public folder
Modify public folder ACL
Unknown specific access (bit 1)
Unknown specific access (bit 3)
Modify public folder expiry

Access Mask: 0


For more information, see Help and Support Center at Events And Errors Message Center: Basic Search.