Re: Auditing-- where?? and why ??



Eng.Rana@xxxxxxxxx wrote:

Dear All,
i hope u r all fine :)

i found that for a secure system u should be auditing ur system
events??
i don c how such a thing adds a level of security??

so i decided to audit my system events and logons using the gpedit.msc,
but i was wondering where r the auditing files stored, where can i view
the events previously auditted??
and how can i benefit from it

That's a pretty sweeping statement and one that I question. It really
depends on your situation and what you mean by auditing system events. We
don't know if you have a standalone machine (running what OS?) or a domain
server taking care of 250 clients. We don't know if this is something you
heard from "a friend's cousin who knows something about computers" or you
are actively trying to harden your server. You will get more focused
answers if you provide more information. Oh, and if you do want more help
please take the time to use conventional English instead of text messaging
abbreviations. This is not a chat room and it makes your post difficult to
read. This will limit your responses.

In the meantime:

Audit User Access of Files, Folders, and Printers in Windows XP -
http://support.microsoft.com/Default.aspx?kbid=310399

Audit Active Directory Objects in Windows Server 2003 -
http://support.microsoft.com/Default.aspx?kbid=814595

To add users or groups to the audit list - http://tinyurl.com/lozjc

Malke
--
MS-MVP Windows Shell/User
Elephant Boy Computers
www.elephantboycomputers.com
"Don't Panic"
.



Relevant Pages

  • Re: Auditing object access from network
    ... server with domain member clients accessing the target file structure via ... I want to audit file deletions in specific directories of a file server, ... NOT BY USERS ACCESSING FILES VIA THE NETWORK. ... Set up auditing ACLs for every entity in Active Directory, ...
    (microsoft.public.win2000.security)
  • Re: Last to Modify
    ... The audit log question is moot though unless you have AD changes being logged ... Joe Richards Microsoft MVP Windows Server Directory Services ... >>To track changes within Active Directory you have to enable auditing. ... >>to track user activities and system-wide events in Active Directory. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Last to Modify
    ... least point the audit log to a specific time? ... > To track changes within Active Directory you have to enable auditing. ... > Microsoft Windows XP - Audit Policy ...
    (microsoft.public.windows.server.active_directory)
  • RE: Monitor File Access, Change or Delete
    ... folder with auditing for Windows Server 2003. ... Locate the file or folder that you want to audit. ... and then click the Auditing tab. ...
    (microsoft.public.windows.server.sbs)
  • HELP - File Auditing
    ... not automatically trigger any new "object access" audit ... individual objects for audit events to be logged. ... To enable auditing on a file/directory do the following: ... GPEDIT.msc in that server, ...
    (microsoft.public.win2000.security)