您好：
近期沒有改到任何設定
只有
目前
FILE SERVER2019 ，11/17 更新 KB5070883
11/18更新 KB890830 惡意軟體移除工具
AD 2012R2 11/18更新 KB890830 惡意軟體移除工具

PC 11.24 裝
2025-11 適用於 x64 系統 Windows 11, version 25H2 的累積更新 (KB5068861) (26200.7171)

但11.27 之後，PC登入網域，
AD SERVER都會出現錯誤LOG，但可以正常登錄
FILE SERVeR 可以存取，但也會出現 錯誤LOG

查gemini，說有可能是 更新的問題
請問前輩們是否有遇過

主旨:
	安全性識別碼:		XX\A01$
	帳戶名稱:		A01$
	帳戶網域:		
	登入識別碼:		0xE9715276

物件:
	物件伺服器:		DS
	物件類型:		group
	物件名稱:		
	控制代碼識別碼:		0x0

操作:
	操作類型:		Object Access
	存取:		控制存取
				
	存取遮罩:		0x100

FILE FERVER

已檢查網路共用物件，查看是否可授與用戶端想要的存取權。
	
主體:
	安全性識別碼:		XX\A09
	帳戶名稱:		A09
	帳戶網域:		XX
	登入識別碼:		0x2102D214

網路資訊:	
	物件類型:		File
	來源位址:		192.168.XX.XX
	來源連接埠:		2668
	
共用資訊:
	共用名稱:		
	共用路徑:		
	相對目標名稱:	099.tmp

存取要求資訊:
	存取遮罩:		0x17019F
	存取:		DELETE
				READ_CONTROL
				WRITE_DAC
				SYNCHRONIZE
				ReadData (或 ListDirectory)
				WriteData (或 AddFile)
				AppendData (或 AddSubdirectory 或 CreatePipeInstance)
				ReadEA
				WriteEA
				ReadAttributes
				WriteAttributes
				
存取檢查結果:
	DELETE:	授與者	D:(A;;0x1301bf;;;WD)
				READ_CONTROL:	授與者	D:(A;;0x1301bf;;;WD)
				WRITE_DAC:	未授與
				SYNCHRONIZE:	授與者	D:(A;;0x1301bf;;;WD)
				ReadData (或 ListDirectory):	授與者	D:(A;;0x1301bf;;;WD)
				WriteData (或 AddFile):	授與者	D:(A;;0x1301bf;;;WD)
				AppendData (或 AddSubdirectory 或 CreatePipeInstance):	授與者	D:(A;;0x1301bf;;;WD)
				ReadEA:	授與者	D:(A;;0x1301bf;;;WD)
				WriteEA:	授與者	D:(A;;0x1301bf;;;WD)
				ReadAttributes:	授與者	D:(A;;0x1301bf;;;WD)
				WriteAttributes:	授與者	D:(A;;0x1301bf;;;WD)
				

謝謝

補充DETAIL
AD 上

- System 

  - Provider 

   [ Name]  Microsoft-Windows-Security-Auditing 
   [ Guid]  {54849625-5478-4994-A5BA-3E3B0328C30D} 
 
   EventID 4662 
 
   Version 0 
 
   Level 0 
 
   Task 14080 
 
   Opcode 0 
 
   Keywords 0x8010000000000000 
 
  - TimeCreated 

   [ SystemTime]  2025-12-03T07:36:29.193400200Z 
 
   EventRecordID 302400967 
 
   Correlation 
 
  - Execution 

   [ ProcessID]  692 
   [ ThreadID]  844 
 
   Channel Security 
 
   Computer AA.DO1.com.tw 
 
   Security 
 

- EventData 

  SubjectUserSid S-1-5-21-1409082233-2000478354-725345543-16672 
  SubjectUserName USERA$ 
  SubjectDomainName DO1 
  SubjectLogonId 0xf9938337 
  ObjectServer DS 
  ObjectType %{bf967a9c-0de6-11d0-a285-00aa003049e2} 
  ObjectName %{6e211015-e1b1-45b2-92c1-1f1c2fe30695} 
  OperationType Object Access 
  HandleId 0x0 
  AccessList %%7688  
  AccessMask 0x100 
  Properties --- {771727b1-31b8-4cdf-ae62-4fe39fadf89e} {612cb747-c0e8-4f92-9221-fdd5f15b550d} {bf967a9c-0de6-11d0-a285-00aa003049e2}  
  AdditionalInfo - 
  AdditionalInfo2  

FILER SERVER

- System 

  - Provider 

   [ Name]  Microsoft-Windows-Security-Auditing 
   [ Guid]  {54849625-5478-4994-a5ba-3e3b0328c30d} 
 
   EventID 5145 
 
   Version 0 
 
   Level 0 
 
   Task 12811 
 
   Opcode 0 
 
   Keywords 0x8010000000000000 
 
  - TimeCreated 

   [ SystemTime]  2025-12-03T07:40:09.534166800Z 
 
   EventRecordID 4566245 
 
   Correlation 
 
  - Execution 

   [ ProcessID]  4 
   [ ThreadID]  8452 
 
   Channel Security 
 
   Computer SERV.DO1.com.tw 
 
   Security 
 

- EventData 

  SubjectUserSid S-1-5-21-1409082233-2000478354-725345543-16650 
  SubjectUserName FS470 
  SubjectDomainName DO1 
  SubjectLogonId 0x315e418f 
  ObjectType File 
  IpAddress 192.168.20.10 
  IpPort 3913 
  ShareName \\*\FIS 
  ShareLocalPath \??\F:\FIS 
  RelativeTargetName   .....\EA5ACD76.xlsx
  AccessMask 0x1f019f 
  AccessList 
  AccessReason 

2025.12.08補上

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4771</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>14339</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2025-12-08T02:09:48.550167600Z" /> 
  <EventRecordID>302830985</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="692" ThreadID="12764" /> 
  <Channel>Security</Channel> 
  <Computer>DC2.xxx.com.tw</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="TargetUserName">US509</Data> 
  <Data Name="TargetSid">S-1-5-21-1409082233-2000478354-725345543-16652</Data> 
  <Data Name="ServiceName">krbtgt/xxx</Data> 
  <Data Name="TicketOptions">0x40810010</Data> 
  <Data Name="Status">0x18</Data> 
  <Data Name="PreAuthType">2</Data> 
  <Data Name="IpAddress">::ffff:192.168.20.100</Data> 
  <Data Name="IpPort">9290</Data> 
  <Data Name="CertIssuerName" /> 
  <Data Name="CertSerialNumber" /> 
  <Data Name="CertThumbprint" /> 
  </EventData>
  </Event>
  
  
  --------------------------------
  
  - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> 
  <EventID>4776</EventID> 
  <Version>0</Version> 
  <Level>0</Level> 
  <Task>14336</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8010000000000000</Keywords> 
  <TimeCreated SystemTime="2025-12-07T23:09:39.398114300Z" /> 
  <EventRecordID>302813356</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="692" ThreadID="844" /> 
  <Channel>Security</Channel> 
  <Computer>DC2.xxx.com.tw</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data Name="PackageName">MICROSOFT_AUTHENTICATION_PACKAGE_V1_0</Data> 
  <Data Name="TargetUserName">FA1044</Data> 
  <Data Name="Workstation">FA1044</Data> 
  <Data Name="Status">0xc000006a</Data> 
  </EventData>
  </Event>
  
--------------------------------