We noticed this kind of audit failure ID 4662 with accesses Control Access in event logs.
One user is trying to control access of approx 100-200 AD objects including computers and users in same time, periodically and result isaudit failure generated in this kind of log.
Rights-GUID {91e647de-d96f-4b70-9557-d63ff4f3ccd8} in Properties underControl access section in log shows on Private-Information Property set
An operation was performed on an object.
Subject :
Security ID:
*********************
Account Name:
***************
Account Domain:**********
Logon ID:
0x17E7EB522
Object:
Object Server:DS
Object Type:
user
Object Name:
***************
Handle ID:
0x0
Operation:
Operation Type:Object Access
Accesses:
Control Access
Access Mask:
0x100
Properties:
---
{91e647de-d96f-4b70-9557-d63ff4f3ccd8}
{6617e4ac-a2f1-43ab-b60c-11fbd1facf05}
{b3f93023-9239-4f7c-b99c-6745d87adbc2}
{b8dfa744-31dc-4ef1-ac7c-84baf7ef9da7}
{b7ff5a38-0818-42b0-8110-d3d154c97f24}
{771727b1-31b8-4cdf-ae62-4fe39fadf89e}
{612cb747-c0e8-4f92-9221-fdd5f15b550d}
{bf967aba-0de6-11d0-a285-00aa003049e2}
Additional Information:
Parameter 1:
-
Parameter 2:
Can somebody please explain this? Thank You