RE: Where would the changes be saved?

From: Damon Sisola (dsisola@osius.com)
Date: 02/07/02 

From: "Damon Sisola" <dsisola@osius.com>
To: "'Patrick S. Harper'" <patrick@internetsecurityguru.com>, <focus-ms@securityfocus.com>
Date: Thu, 7 Feb 2002 12:44:59 -0800

In the registry at: HKLM\system\currentcontrolset\services\eventlog

there will be a Maxsize and retention value for each of the 3 logs.

Damon

-----Original Message-----
From: Patrick S. Harper [mailto:patrick@internetsecurityguru.com]
Sent: Thursday, February 07, 2002 12:18 PM
To: focus-ms@securityfocus.com
Subject: Where would the changes be saved?

When you make a change to a windows 2000 servers auditing and log
rotation where is that info stored? I have looked all through the
registry and searched all over the HDD and found nothing but a few
.dll's and .inf files. If I make changes to the .inf files directly it
does not affect the policy. This is for a machine that is standalone or
in an NT4 domain so pushing it out is not an option. Any advice
welcome. Thanks

Patrick Harper

Relevant Pages

  • RE: Where would the changes be saved?
    ... system about to be put into my test domain. ... there will be a Maxsize and retention value for each of the 3 logs. ... registry and searched all over the HDD and found nothing but a few ... If I make changes to the .inf files directly it ...
    (Focus-Microsoft)
  • Re: Remotley managing XP Pro systems
    ... > Event Viewer logs or parts of the registry. ... > accessing Event Viewer is curious since he can access it locally?? ... >>> Steve, ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Non admin users cant do things they need to do
    ... can set the time then they can fake out system event logs by changing ... Double-click on the file to add data to the registry ... right you can do it through a local security policy. ... not an administrator. ...
    (microsoft.public.windowsxp.embedded)
  • Re: SLOW BOOT - NEED ADVICE
    ... boot up time is still very slow. ... System or Application Event logs. ... message says that the Registry cannot unload my Classes Registry File ... Where do I start looking to find the office computer problem? ...
    (microsoft.public.windowsxp.general)
  • Re: Update Rollup 1 for Windows 2000 SP4 - Access Denied Error
    ... > time I run it it gets as far as "updating registry" and then it pops open a ... There are supposed to be verbose logs which might help supplement ... Update Rollup 1 installation did not complete. ...
    (microsoft.public.windowsupdate)