SMS: Collection Evaluator May Cause Many Event ID 565 Events (311258)
The information in this article applies to:
- Microsoft Systems Management Server 2.0
This article was previously published under Q311258 SYMPTOMS
In a Microsoft Windows 2000 Active Directory-based environment with Systems Management Server (SMS) 2.0 Service Pack 2 (SP2) or later installed and success auditing of directory service access enabled, the SMS Service account may generate many Event ID 565 entries in the Security event log.
CAUSE
This behavior occurs because the SMS Service account's group membership is evaluated repeatedly as Collection Evaluator monitors collections.
WORKAROUND
To work around this problem, disable the success auditing of directory service accesses.
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
| Modification Type: | Minor | Last Reviewed: | 6/14/2005 |
|---|
| Keywords: | kbBug kbprb KB311258 |
|---|
|