Re: Event Viewer and Security View

From: x y (jamescagney90210@yahoo.com)
Date: 05/21/02


From: "x y" <jamescagney90210@yahoo.com>
Date: Tue, 21 May 2002 07:11:13 -0400


I don't think there is a good way to do this included in the GUI. However,
perhaps using Process Explorer from www.sysinternals.com may let you see
various objects on the computer and allow you to double-click on them to
change the auditing and security to disable auditing on some obscure objects
that are not clearly listed anywhere else that I know of in the Windows GUI
[unless maybe they are represented by values and keys in the registry].

"Fritz" <pjfritzler@earthlink.net> wrote in message
news:4ec501c20078$82627000$9ee62ecf@tkmsftngxa05...
> Is there any way when I am auditing object access (success
> and failure) that I can limit what part of the event is
> actually logged?
>
> The problem I have is that when I configure a single event
> to audit such as "traverse", every single handle event is
> logged. This will generate 6 separate events per
> instance, all but two of them basically useless.
>
> Yes, I know that I can filter the events that I actually
> view, but this just causes a long delay when I open the
> view itself. In addition, these "handle" events just load
> up the log and consume disk space for no reason.
>
> HELP!
>
> Thanks in advance,
>
> Fritz
>



Relevant Pages