Re: Event Viewer and Security View

From: x y (
Date: 05/21/02

From: "x y" <>
Date: Tue, 21 May 2002 07:11:13 -0400

I don't think there is a good way to do this included in the GUI. However,
perhaps using Process Explorer from may let you see
various objects on the computer and allow you to double-click on them to
change the auditing and security to disable auditing on some obscure objects
that are not clearly listed anywhere else that I know of in the Windows GUI
[unless maybe they are represented by values and keys in the registry].

"Fritz" <> wrote in message
> Is there any way when I am auditing object access (success
> and failure) that I can limit what part of the event is
> actually logged?
> The problem I have is that when I configure a single event
> to audit such as "traverse", every single handle event is
> logged. This will generate 6 separate events per
> instance, all but two of them basically useless.
> Yes, I know that I can filter the events that I actually
> view, but this just causes a long delay when I open the
> view itself. In addition, these "handle" events just load
> up the log and consume disk space for no reason.
> Thanks in advance,
> Fritz

Relevant Pages