RE: Auditing a reboot

From: dave (dave@netmedic.net)
Date: 04/22/03

  • Next message: ashah@sevenspace.com: "Files in system 32 directory" 
    From: "dave" <dave@netmedic.net>
To: <focus-ms@securityfocus.com>
Date: Tue, 22 Apr 2003 03:07:53 -0400

    Well if you do not want to infer you can:

    In your Audit Policy of your Security Settings make sure you have "Audit
    Privilege Use" turned on for Success and Failure.

    In the Security Log you will see an Event ID #578, Privilege Use for
    SeShutdownPrivilege, every time someone invokes it.

    Now #578 Privilege Use is used for other Privilege Uses as well. So you
    will see them listed quite often. It is easiest to look at the System Log
    and see what time the "Event Service" Stopped and then look in the Security
    Log for #578 for the previous 2 minutes.

    It lists all the info you want:

    Privileged object operation:
             Object Server: EventLog
             Object Handle: 0
             Process ID: 224
             Primary User Name: xxxxxx
             Primary Domain: xxxxxx
             Primary Logon ID: (hex number)
             Client User Name: xxxxxx
             Client Domain: xxxxxx
             Client Logon ID: (hex number)
             Privileges: SeShutdownPrivilege

    Hope this helps.

    _____________________
    Dave Kleiman
    dave@netmedic.net
    www.netmedic.net

     

    -----Original Message-----
    From: Logan F.D. Greenlee [mailto:lgreenlee@ciretose.net]
    Sent: Monday, April 21, 2003 15:25
    To: Hillensbeck, Preston; focus-ms@securityfocus.com
    Subject: RE: Auditing a reboot

    Preston,

    If you use success auditing for loggons and logoffs you can infer the
    rebooting user from the the security log.

    - Logan

    > -----Original Message-----
    > From: Hillensbeck, Preston [mailto:PHillensbeck@sfbcic.com]
    > Sent: Monday, April 21, 2003 8:34 AM
    > To: 'Brad Judy'; focus-ms@securityfocus.com
    > Subject: RE: Auditing a reboot
    >
    >
    > I guess I should have been more specific! What I am trying
    > to audit is an event that says who or what rebooted the
    > machine. I see the normal 6005 and 6009 event messages, but
    > I would really like to know who initiated the reboot. Is
    > this possible?

    -----------------------------------------------------------------------------
    Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the
    world's premier event for IT and network security experts. The two-day
    Training features 6 hand-on courses on May 12-13 taught by professionals.
    The two-day Briefings on May 14-15 features 24 top speakers with no vendor
    sales pitches. Deadline for the best rates is April 25. Register today to
    ensure your place. http://www.securityfocus.com/BlackHat-focus-ms
    ------------------------------------------------------------------------------

  • Next message: ashah@sevenspace.com: "Files in system 32 directory"

    Relevant Pages

    • Re: ASP.NET Impersonation / delegation
      ... If your security guys will not even allow delegation, ... Bruce - I think this is a major right to grant to the ASPNet account. ... I have included a description on SE_TCB_NAME privilege from one of the MS ...
      (microsoft.public.dotnet.framework.aspnet)
    • Re: Event ID 577 & Failed Install of Microsoft Firewall Client
      ... NT Local Security Authority / Authentication Service ... Primary Domain: <domain or workgroup name> ... Client Domain: ... privilege to perform a privileged system service. ...
      (microsoft.public.security)
    • Re: Event ID 577 & Failed Install of Microsoft Firewall Client
      ... NT Local Security Authority / Authentication Service ... Primary Domain: <domain or workgroup name> ... Client Domain: ... privilege to perform a privileged system service. ...
      (microsoft.public.win2000.security)
    • RE: syslog
      ... For the same kind of environment, I am using Computer Associates eTrust ... Audit integrated with Security command center for an easy event management ... and consolidation of logs + administration of all the Security ...
      (Security-Basics)
    • RE: Blue Team ROE
      ... These types of constraints are a way to create the illusion of due ... diligence in that they are having an outside company perform a security ... the audit by client constraints. ... Cenzic Hailstorm finds vulnerabilities fast. ...
      (Pen-Test)