SQL Server 2000 Does What?!?!?!

After hardening a Production SQL Server Cluster, and reviewing the Secuirty Logs to make sure all was well, among many other strange things I saw SQL Server trying to do, I ran across this gem:

Event Type: Failure Audit
Event Source: Security
Event Category: Object Access 
Event ID: 560
Date:  2/16/2007
Time:  11:44:36 AM
User:  DOMAIN\SQLServiceAccountName
Computer: COMPUTERNAME
Description:
Object Open:
        Object Server: Security
  Object Type: File
  Object Name: C:\AUTOEXEC.BAT
  Handle ID: -
  Operation ID: {0,533511}
  Process ID: 872
  Image File Name: 
  Primary User Name: MACHINE$
  Primary Domain: DOMAIN
  Primary Logon ID: (0x0,0x3E7)
  Client User Name: SQLServiceAccountName
  Client Domain: DOMAIN
  Client Logon ID: (0x0,0x822BB)
  Accesses: READ_CONTROL 
   SYNCHRONIZE 
   ReadData (or ListDirectory) 
   ReadEA 
   ReadAttributes 
   
  Privileges: -
  Restricted Sid Count: 0
  Access Mask: 0x120089


Pretty cool, eh?

0 comments: