Windows Security Log Event ID 565

565: Object Open (Active Directory)

On this page

• Description of this event
• Field level details
• Examples
• Mini-seminars on this event

This event varies depending on the OS.

Win2000

Event 565 allows you to track changes to Active Directory objects down to the property level. While Account Management provides more useful auditing for changes to users, groups and computers, Directory Service Access events are the only way to monitor potentially far reaching effects of changes to organizational units, group policy objects, domains and site related objects.

Event 565 is similar to event 560 but is limited to recording open events on Active Directory objects. Event 565 is therefore only logged on domain controllers.

Auditing on desired container and leaf objects must be enabled for event 565 to be logged. Open properties dialog of object, select Security tab, click Advanced and select Auditing tab. Event 565 allows you to track new objects created in AD, changes to existing object and deletes.

Object Type specifies the class object as specified in the schema for this forest. Common object types:
user
group
gpContainer (group policy object)
dnsDomain (domain)
organizational unit

Object Name: X500 distinguished name of the object.

Primary fields: always correspond to the directory service process and domain controller account.

Client fields: identify the user (usually some level of an administrator) that accessed the object.

Accesses: Identify the permissions requested by user/program to the object. These accesses directly correspond to the object level and property level permissions you see in the access control list of the associated object in Active Directory. Write Property and Read Property accesses will be followed by the actual properties written to or read.

Object types and property names can be cryptic. Use the Active Directory Schema Management MMC snap-in to understand the meaning.

Write_DAC indicates the user/program attempted to change the permissions on the object.

You will only see event 565 on domain controllers.

Win2003

Additional fields are logged for this event by W3 including:

Process Name: name of the executable that accessed the object.

You will only see event 565 on domain controllers.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 565

• Object Server:
• Object Type:
• Object Name:
• New Handle ID:
• Operation ID
• Process ID:
• Process Name: (Windows Server 2003 only)
• Primary User Name:
• Primary Domain
• Primary Logon ID:
• Client User Name:
• Client Domain:
• Client Logon ID:
• Accesses
• Privileges
• Properties
• Access Mask: (Windows Server 2003 only)

Supercharger Free Edition

Centrally manage WEC subscriptions.

Free.

 

Mini-Seminars Covering Event ID 565 Monitoring Active Directory for Security and Compliance: How Far Does the Native Audit Log Take You?

 

Upcoming Webinars Unpacking a Linux Supply Chain Compromise Using the Recently Published XZ Utils Backdoor as the Example Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy