Re: Audit not working.

From: Eric Fitzgerald [Microsoft] (ericf@online.microsoft.com)
Date: 02/22/02 

From: "Eric Fitzgerald [Microsoft]" <ericf@online.microsoft.com>
Date: Fri, 22 Feb 2002 11:07:37 -0800

Hi Dexter,

Try this:

1. Make sure that your security log is set to "overwrite events as needed".
2. Use User Manager to set your audit policy to actually log security
events.
3. The total aggregate size of your log files (system+application+security)
should be lower than 512MB.
4. Save & clear your security log.

Eric Fitzgerald
Program Manager, Windows Auditing & Intrusion Detection
Microsoft Corporation 

--
This posting is provided "AS IS" with no warranties, and confers no rights.

"Dexter D." <edwrobel@interia.pl> wrote in message
news:1013790449.627128@kwark.quantum.pl...
> Hi,
> Audit on one of my servers (win nt 4.0) does not write any logs to
security
> event viewer. Audit is set up correctly. Is there some king of bug? If so,
> how to correct it.
> Thanks,
> Dexter.
>
>

Relevant Pages

  • Re: Ghost in the Recycle Bin
    ... Audit account logon events ... Prevent local guests group from accessing application log ... Prevent local guests group from accessing security log ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: administrator sign on
    ... I dont' think Windows audits this by default. ... Event log in the Security log, in the Computer Management MMC. ... also audit success of, say, logon events, and probably also system events, ...
    (microsoft.public.security)
  • Re: Audit the administrator account?
    ... In a Windows NT domain, the security log of the PDC can be configured to ... "Audit these events" and turn on auditing for "User and Group Management"... ... Event Log for the PDC for event ID 628. ...
    (microsoft.public.win2000.security)
  • Re: Audit problem
    ... I already enabled the suditing ... fail audit options. ... Then, try to check your security log, ... >> I enable object access audit setting and apply all audit ...
    (microsoft.public.win2000.security)
  • Re: DC Policy: just want to audit files, not set security
    ... definition to deliver only Audit SACL to some storage ... > to audit everything. ... Just enabling auditing of object access will generate ... > lot of events in the security log. ...
    (microsoft.public.windows.server.security)