An "event ID 516" audit record may be incorrectly logged when an access attempt to a named pipe occurs in Windows Server 2003 or in Windows XP (922769)

SYMPTOMS

EventID 516
 

Internal resources allocated for the queuing of audit messages have been exhausted, leading to the loss of some audits. 

       Number of audit messages discarded:      1

• The "Audit object Access" policy is enabled.
• An access attempt to a named pipe occurs. This named pipe has a system access control list (SACL) in its security descriptor.
• Windows makes an access control determination for this access attempt.

EventID 560
 

Object Open:

       Object Server:       Security

       Object Type:  NamedPipe

       Object Name:  \AuditTest

       Handle ID:    1884

       Operation ID: {0,223884}

       Process ID:   1384

       Image File Name:     C:\NamedPipeAudit.exe

       Primary User Name:   Administrator

       Primary Domain:      W03SA

       Primary Logon ID:    (0x0,0x880B)

       Client User Name:    -

       Client Domain:       -

       Client Logon ID:     -

       Accesses:     READ_CONTROL 

                     SYNCHRONIZE 

                     ReadData (or ListDirectory) 

                     WriteData (or AddFile) 

                     AppendData (or AddSubdirectory or CreatePipeInstance) 

                     ReadEA 

                     WriteEA 

                     ReadAttributes 

                     WriteAttributes 

                     

       Privileges:   -

       Restricted Sid Count:      0

       Access Mask:  0x12019F