Someone

Event Type:	Failure Audit
Event Source:	Security
Event Category:	Object Access 
Event ID:	560
Date:		5/9/2007
Time:		3:16:20 PM
User:		SALESIANUM\097440kt
Computer:	SALESFS-01
Description:
Object Open:
 	Object Server:	SC Manager
 	Object Type:	SC_MANAGER OBJECT
 	Object Name:	ServicesActive
 	Handle ID:	-
 	Operation ID:	{0,123063136}
 	Process ID:	1308
 	Image File Name:	C:\WINDOWS\system32\services.exe
 	Primary User Name:	SALESFS-01$
 	Primary Domain:	SALESIANUM
 	Primary Logon ID:	(0x0,0x3E7)
 	Client User Name:	097440kt
 	Client Domain:	SALESIANUM
 	Client Logon ID:	(0x0,0x71AB49E)
 	Accesses:	READ_CONTROL 
			Connect to service controller 
			Enumerate services 
			Query service database lock state 
			
 	Privileges:	-
 	Restricted Sid Count:	0
 	Access Mask:	0x20015


For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.