Figure 2: Event ID 560 sample

Event Type:			Success Audit
Event Source:			Security
Event Category:		Object Access
Event ID:			560
Date:					10/11/2004
Time:					9:07:50 PM
User:					ELM\Fred
Computer:			W3DC
Description:
Object Open:
   Object Server:		Security
   Object Type:			File
   Object Name:		C:\DeptFiles
   Handle ID:			1156
   Operation ID:		{0,251509}
   Process ID:			2936
   Image File Name:		C:\WINDOWS\explorer.exe
   Primary User Name:	Fred
   Primary Domain:		ELM
   Primary Logon ID:		(0x0,0x13388)
   Client User Name:		- 
   Client Domain:		-
   Client Logon ID:		-
   Accesses:			READ_CONTROL
WRITE_DAC
ReadAttributes

   Privileges:			-
   Restricted SID 	
   Count:			0
   Access Mask:		0x60080