On a computer that is running Microsoft Application Center 2000, you configure Group Policy or Local Security Policy to audit access to an object. In this scenario, the following event is logged in the Security log:

Event Category: Object Access
Event ID: 560
Date: date
Time: time
User: Server_name\ACL_server_name
Computer: server_name
Description:
Object Open:
Object Server: SC Manager
Object Type: SERVICE OBJECT
Object Name: RemoteAccess
Handle ID:
Operation ID: {0,3338797}
Process ID: 632
Image File Name: C:\WINDOWS\system32\services.exe
Primary User Name: Primary_user_name
Primary Domain: Primary_domain
Primary Logon ID: (0x0,0x3E7)
Client User Name: ACL_server_name
Client Domain: Server_name
Client Logon ID: (0x0,0x223F5)
Accesses: Query status of service

This issue occurs because of some Application Center 2000 code that enumerates the services on the system to obtain status information. A security template may lock down the system that prevents access by unprivileged local accounts.

Note You can safely ignore event ID 560.

The Remote Access service must have the SERVICE_QUERY_STATUS permission for the Authenticated Users group. You can modify the security template or Group Policy to obtain the SERVICE_QUERY_STATUS permission for at least the ACL_ account.

To assign permissions for system services, follow these steps:

1. Start Active Directory Users and Computers. To do this, click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. Right-click the organizational unit (OU) that you want, and then click Properties.
3. Click the Group Policy tab, click the Group Policy object that you want to modify in the Current Group Policy Objects Links for OU_name list, and then click Edit.
4. In the console tree, expand Computer Configuration, and then expand Windows Settings.
5. Expand Security Settings, and then click System Services.
6. In the details pane, double-click the service to which you want to assign permissions, and then click to select the Define this policy setting check box.
7. Click Edit Security, assign the appropriate permissions to the user groups that you want, and then click OK.
8. Under Select service startup mode, click the startup mode option that you want, and then click OK.
9. Exit the Group Policy Object Editor, click OK, and then exit Active Directory Users and Computers.