WIN SERVER 出現錯誤LOG

noway
2025-11-28 09:41:41

您好：
近期沒有改到任何設定
只有
目前
FILE SERVER2019 ，11/17 更新 KB5070883
11/18更新 KB890830 惡意軟體移除工具
AD 2012R2 11/18更新 KB890830 惡意軟體移除工具

PC 11.24 裝
2025-11 適用於 x64 系統 Windows 11, version 25H2 的累積更新 (KB5068861) (26200.7171)

但11.27 之後，PC登入網域，
AD SERVER都會出現錯誤LOG，但可以正常登錄
FILE SERVeR 可以存取，但也會出現 錯誤LOG

查gemini，說有可能是 更新的問題
請問前輩們是否有遇過

主旨:
	安全性識別碼:		XX\A01$
	帳戶名稱:		A01$
	帳戶網域:
	登入識別碼:		0xE9715276

物件:
	物件伺服器:		DS
	物件類型:		group
	物件名稱:
	控制代碼識別碼:		0x0

操作:
	操作類型:		Object Access
	存取:		控制存取

	存取遮罩:		0x100

FILE FERVER

已檢查網路共用物件，查看是否可授與用戶端想要的存取權

主體:
	安全性識別碼:		XX\A09
	帳戶名稱:		A09
	帳戶網域:		XX
	登入識別碼:		0x2102D214

網路資訊:
	物件類型:		File
	來源位址:		192.168.XX.XX
	來源連接埠:		2668

共用資訊:
	共用名稱:
	共用路徑:
	相對目標名稱:	099.tmp

存取要求資訊:
	存取遮罩:		0x17019F
	存取:		DELETE
				READ_CONTROL
				WRITE_DAC
				SYNCHRONIZE
				ReadData (或 ListDirectory)
				WriteData (或 AddFile)
				AppendData (或 AddSubdirectory 或 CreatePipeInstance)
				ReadEA
				WriteEA
				ReadAttributes
				WriteAttributes

存取檢查結果:
	DELETE:	授與者	D:(A;;0x1301bf;;;WD)
				READ_CONTROL:	授與者	D:(A;;0x1301bf;;;WD)
				WRITE_DAC:	未授與
				SYNCHRONIZE:	授與者	D:(A;;0x1301bf;;;WD)
				ReadData (或 ListDirectory):	授與者	D:(A;;0x1301bf;;;WD)
				WriteData (或 AddFile):	授與者	D:(A;;0x1301bf;;;WD)
				AppendData (或 AddSubdirectory 或 CreatePipeInstance):	授與者	D:(A;;0x1301bf;;;WD)
				ReadEA:	授與者	D:(A;;0x1301bf;;;WD)
				WriteEA:	授與者	D:(A;;0x1301bf;;;WD)
				ReadAttributes:	授與者	D:(A;;0x1301bf;;;WD)
				WriteAttributes:	授與者	D:(A;;0x1301bf;;;WD)

謝謝

補充DETAIL
AD 上

- System

  - Provider

   [ Name]  Microsoft-Windows-Security-Auditing
   [ Guid]  {54849625-5478-4994-A5BA-3E3B0328C30D}

   EventID 4662

   Version 0

   Level 0

   Task 14080

   Opcode 0

   Keywords 0x8010000000000000

  - TimeCreated

   [ SystemTime]  2025-12-03T07:36:29.193400200Z

   EventRecordID 302400967

   Correlation

  - Execution

   [ ProcessID]  692
   [ ThreadID]  844

   Channel Security

   Computer AA.DO1.com.tw

   Security


- EventData

  SubjectUserSid S-1-5-21-1409082233-2000478354-725345543-16672
  SubjectUserName USERA$
  SubjectDomainName DO1
  SubjectLogonId 0xf9938337
  ObjectServer DS
  ObjectType %{bf967a9c-0de6-11d0-a285-00aa003049e2}
  ObjectName %{6e211015-e1b1-45b2-92c1-1f1c2fe30695}
  OperationType Object Access
  HandleId 0x0
  AccessList %%7688
  AccessMask 0x100
  Properties --- {771727b1-31b8-4cdf-ae62-4fe39fadf89e} {612cb747-c0e8-4f92-9221-fdd5f15b550d} {bf967a9c-0de6-11d0-a285-00aa003049e2}
  AdditionalInfo -
  AdditionalInfo2

FILER SERVER

- System

  - Provider

   [ Name]  Microsoft-Windows-Security-Auditing
   [ Guid]  {54849625-5478-4994-a5ba-3e3b0328c30d}

   EventID 5145

   Version 0

   Level 0

   Task 12811

   Opcode 0

   Keywords 0x8010000000000000

  - TimeCreated

   [ SystemTime]  2025-12-03T07:40:09.534166800Z

   EventRecordID 4566245

   Correlation

  - Execution

   [ ProcessID]  4
   [ ThreadID]  8452

   Channel Security

   Computer SERV.DO1.com.tw

   Security


- EventData

  SubjectUserSid S-1-5-21-1409082233-2000478354-725345543-16650
  SubjectUserName FS470
  SubjectDomainName DO1
  SubjectLogonId 0x315e418f
  ObjectType File
  IpAddress 192.168.20.10
  IpPort 3913
  ShareName \\*\FIS
  ShareLocalPath \??\F:\FIS
  RelativeTargetName   .....\EA5ACD76.xlsx
  AccessMask 0x1f019f
  AccessList
  AccessReason

2025.12.08補上

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
  <EventID>4771</EventID>
  <Version>0</Version>
  <Level>0</Level>
  <Task>14339</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8010000000000000</Keywords>
  <TimeCreated SystemTime="2025-12-08T02:09:48.550167600Z" />
  <EventRecordID>302830985</EventRecordID>
  <Correlation />
  <Execution ProcessID="692" ThreadID="12764" />
  <Channel>Security</Channel>
  <Computer>DC2.xxx.com.tw</Computer>
  <Security />
  </System>
- <EventData>
US509
S-1-5-21-1409082233-2000478354-725345543-16652
krbtgt/xxx
0x40810010
0x18
2
::ffff:192.168.20.100
9290



  </EventData>
  </Event>


  --------------------------------

  - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
  <EventID>4776</EventID>
  <Version>0</Version>
  <Level>0</Level>
  <Task>14336</Task>
  <Opcode>0</Opcode>
  <Keywords>0x8010000000000000</Keywords>
  <TimeCreated SystemTime="2025-12-07T23:09:39.398114300Z" />
  <EventRecordID>302813356</EventRecordID>
  <Correlation />
  <Execution ProcessID="692" ThreadID="844" />
  <Channel>Security</Channel>
  <Computer>DC2.xxx.com.tw</Computer>
  <Security />
  </System>
- <EventData>
MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
FA1044
FA1044
0xc000006a
  </EventData>
  </Event>

--------------------------------