I am getting Failure Audit items of several flavors from SQL Agent when
running SSIS packages. In addition, it causes the SSIS jobs to fail.

We are using the local groups established by SQL Server 2005 install to
secure the domain account used for the agent. I assume that we have a
GPO that is causing this, but would like to present the evidence to get
the GPO changed.

Env: Windows 2003 SE SP1, SQL Server 2005 EE November RTM

TIA, Randy


Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 1/10/2006
Time: 6:53:37 AM
User: Domain\SQLAgentAccount
Computer: COMPUTERNAME
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\WINDOWS\system32\CCM\FrameworkPerf.dll
Handle ID: -
Operation ID: {0,2937378}
Process ID: 3300
Image File Name: C:\Program Files\Microsoft SQL
Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE
Primary User Name: SQLAgentAccount
Primary Domain: Domain
Primary Logon ID: (0x0,0x2C2382)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: ReadAttributes

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x80


Another example:

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access
Event ID: 560
Date: 1/10/2006
Time: 6:53:37 AM
User: Domain\SQLAgentAccount
Computer: COMPUTERNAME
Description:
Object Open:
Object Server: Security
Object Type: File
Object Name: C:\
Handle ID: -
Operation ID: {0,2938118}
Process ID: 3300
Image File Name: C:\Program Files\Microsoft SQL
Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE
Primary User Name: SQLAgentAccount
Primary Domain: Domain
Primary Logon ID: (0x0,0x2C2382)
Client User Name: -
Client Domain: -
Client Logon ID: -
Accesses: SYNCHRONIZE
ReadData (or ListDirectory)

Privileges: -
Restricted Sid Count: 0
Access Mask: 0x100001