Re: Audit Failures/READ_CONTROL SYNCHRONIZE

From: Jonathan (jonsteph283@hotmail.com)
Date: 03/25/02 

From: "Jonathan" <jonsteph283@hotmail.com>
Date: Mon, 25 Mar 2002 18:52:16 GMT

You're auditing File and Object Access; you've enabled Auditing on the files
in the Winnt\System32 directory, and you're complaining about audit events
in your Security log? :-)

That particular audit event indicates that the SYSTEM requested a handle to
the file CMD.EXE. When it did so, it requested the following accesses:

READ_CONTROL
SYNCHRONIZE
ReadData (or ListDirectory)
ReadEA
ReadAttributes
WriteAttributes

You didn't include the entire event, so I can't tell if this is a Success or
Failure audit.

You can't mask events out of the security log in Event Viewer. You could
export the events to a database on a regular basis and then filter the
records in the database to suit you.

I recommend that you take a look at this book in order to learn how and why
to configure auditing on Windows NT:
http://www.amazon.com/exec/obidos/ASIN/157231818X/qid=1017082254/sr=8-2/ref=
sr_8_7_2/102-1580918-9288917

                            -- Jonathan

"Binesh Bannerjee" <binesh-dated-1017664938.655328@hex21.com> wrote in
message news:a7n5vh$ouf$1@bob.news.rcn.net...
>
> Hi...
> OK, so I made myself a PDC, created a few users made the
> NETLOGON, and PROFILE shares and home directories, and everything was
> just fine. Then, I decided to tighten security on the boxes...
>
> I removed Everyone everywhere, and replaced it with Authenticated
> Users on both registry keys and files, and by default, they have
> RX/RX (on directories and files)... Then, I had to change
HKEY_USERS/.DEFAULT
> to allow full access by all authenticated users? (Why is this? I don't
> understand why it needs this... (I went through each option (Query
> Value, Set Value ... etc. and only full control worked... *shrug*)))
> anyway, that's all great. Where I'm stumped is at the following
> Audit entries: I get 600 of them each time a user logs in:
> Object Open:
> Object Server: Security
> Object Type: File
> Object Name: C:\WINNT\system32\CMD.EXE
> New Handle ID: -
> Operation ID: {0,244425}
> Process ID: 2156795904
> Primary User Name: SYSTEM
> Primary Domain: NT AUTHORITY
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: binesh
> Client Domain: HEX21
> Client Logon ID: (0x0,0x3B029)
> Accesses READ_CONTROL
> SYNCHRONIZE
> ReadData (or ListDirectory)
> ReadEA
> ReadAttributes
> WriteAttributes
> Privileges -
>
> Now, the accesses... Is that a list of things it couldn't do?
> Or is that like a stack trace of some function?
>
> Anyway, why is it happening? And, how do I prevent it or at least
> mask it from the logs, (if it's harmless)?
>
> permissions on C:\WINNT\system32\CMD.EXE =
> Administrators Full Control (All)
> Authenticated Users Read(RX)
> SYSTEM Full Control (All)
>
> It's not just the C:\WINNT\system32\CMD.EXE, tho, it's several files
> (I THINK every file accessed...) I've turned off Last Access Timestamp
> by adding the Registry key NtfsDisableLastAccessUpdate, so that shouldn't
> be it... I'm stumped!
>
> Any ideas/suggestions?
> Thanks,
> Binesh Bannerjee
>
>

Relevant Pages

  • Re: Authentication Auditing
    ... > only show in the security log of the domain computer itself - not the ... > it indeed does show that auditing of logon events is enabled for success ... It is enabled but the effective setting dispalys as "No Auditing". ...
    (microsoft.public.win2000.security)
  • Re: Monitor User Remotely.
    ... activity, auditing of process tracking on ... remotely via administrator share, and folder files have creation timestamps ... he can clear the security log. ... > Is there any way we can remotely monitor him, ...
    (microsoft.public.win2000.security)
  • Re: Auditing file changes
    ... You might want to have them check who is the owner of the file. ... object access in Local Security Policy on the computer and enable auditing ... on the folder or file they need to track. ... security log size will need to be increased substantially to probably at ...
    (microsoft.public.win2000.security)
  • Re: Cannot see audit events in security log
    ... I tried turning auditing off and on again after converting to NTFS in ... > If you enabled auditing of object access then you should see events in the ... > the size of the security log quite a bit and clear the log first. ... >> trying to establish auditing on a folder and its contents. ...
    (microsoft.public.win2000.security)
  • Re: ADAM Auditing
    ... Auditing in ADAM shows up in the security event log. ... I'd have to see the script you used, but the short answer is that you can ... There are really 3 steps to enabling auditing in ADAM: ... Ensure that ADAM has the required permissions to write audit events - ...
    (microsoft.public.windows.server.active_directory)