Re: Empty Security Event Log

From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 09/13/03 

Date: Fri, 12 Sep 2003 15:51:42 -0700

What's the output of these commands?

cd %systemdrive%
dir %systemroot%\system32\config\security.evt
cacls %systemroot%\system32\config\security.evt

What size is your log? Don't make it any larger than 250MB.

Have you tried clearing it?

Thanks,
Eric 

-- 
Eric Fitzgerald
Program Manager, Windows Auditing
Microsoft Corporation
The above message is provided "AS-IS" with no warranties, and confers no
rights.
"Rob Milman" <rmilman@graycon.com> wrote in message
news:0f3d01c36277$7c037ee0$a601280a@phx.gbl...
> I have built a Windows 2000 Server and joined it to a NT
> 4.0 domain.  I've turned on auditing for everything
> including all  files and folders.  But the Security Event
> Log is empty.  I've increased the size of it and allowed
> events to be overwritten.  The only entry the shows up is
> when I clear it.  I can find nothing on Google or Technet
> that addresses this problem.  I've built many Windows 2000
> servers and have never ran into this issue before.  Does
> anyone have an idea what could be happening?
>
> Thanks,
>
> Rob Milman

Relevant Pages

  • Removing BDC Server
    ... I'm in the process of upgrading a NT4.0 domain to Windows ... 2003 AD. I've built a new server with NT4.0 promoted it ... to the PDC and will do an in-place upgrade to Windows ...
    (microsoft.public.windows.server.migration)
  • Empty Security Event Log
    ... I have built a Windows 2000 Server and joined it to a NT ... But the Security Event ...
    (microsoft.public.security)
  • Unusal Session State behavior or Server side validation?
    ... I have an internal intranet site that I have built using asp.net (via VS ... When I launched the site, it was on a windows 2000 server, using ... Recently I have moved the site to a new web server that I built. ... As a user works with the app, other panels switch between being ...
    (microsoft.public.dotnet.framework.aspnet)
  • Newbie: Replacing Win 2K with WinXP machine
    ... His old one runs Windows 2000. ... First I gave it a name when I built it. ... The server tells me that authenticated users are permitted ... instructions that you real experts can offer. ...
    (microsoft.public.windows.server.sbs)
  • user logon time tracking
    ... Is 680 the only security event to find out when someone has logged on in the ... Windows 2003 Server. ... Bryce. ...
    (microsoft.public.windows.server.security)