Re: Locking down Event Viewer

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 10/21/05

  • Next message: Brad Baker: "Re: password expiration policy for admin and system accounts ?" 
    Date: Fri, 21 Oct 2005 14:20:54 -0500

    Ultimately you can not prevent a knowledgeable and determined administrator
    from clearing the logs or doing about anything else. You could try adding
    the users that you wan to restrict to the guests group and then configure
    Group Policy to restrict access to the event logs for members of the guests
    group or you could try changing the user right for "manage auditing and
    security logs" to only include the groups or users that you want. ---
    Steve

    "hockeytown_rox" <hockeytownrox@discussions.microsoft.com> wrote in message
    news:428A3BEC-C1B3-4AE4-83BA-3B51CC0F882B@microsoft.com...
    > Is there a way through policy or other means to lock down or prevent users
    > from deleting entries in event viewer? We only want one user to be able
    > to
    > do this in the entire domain and dont want admins to have the ability to
    > delete events.
    >
    > any advice on event viewer security best practices?

  • Next message: Brad Baker: "Re: password expiration policy for admin and system accounts ?"

    Relevant Pages

    • Re: SVC host problem
      ... Interpreting HiJackThis logs is done in specialist forums and the ... I am not sure why you think you need to employ HijackThis. ... You can access Event Viewer by selecting Start, Control Panel, ... Adobe PDF Conversion Toolbar Helper - ...
      (microsoft.public.windowsxp.general)
    • Re: SVC host problem
      ... Interpreting HiJackThis logs is done in specialist forums and the ... posting of these logs is discouraged here. ... You can access Event Viewer by selecting Start, Control Panel, ... Adobe PDF Conversion Toolbar Helper - ...
      (microsoft.public.windowsxp.general)
    • Re: Login screen failure
      ... I noticed there was a Windows update waiting to be installed last time I ... To see the Event Viewer logs, click Start, Settings, Control Panel, ... The most interesting logs are usually the Application and System. ... Warnings will have yellow!s. ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: How do I repair lsass.exe ?
      ... Download, install, update and do a full scan with these free malware ... To see the Event Viewer logs, click Start, Settings, Control Panel, ... The most interesting logs are usually the Application and System. ... Some are excusable at startup time when Windows is booting. ...
      (microsoft.public.windowsxp.help_and_support)
    • Re: computer getting slow for not the usual reasons
      ... A tip for posting copies of Error Reports! ... Make sure this is the first paste after exiting from Event Viewer. ... I am registered at aumba and have used hijackthis, ... I will check out "HOW TO: View and Manage Event Logs", ...
      (microsoft.public.windowsxp.general)