Re: Audit the administrator account?

From: Grog in Ohio (Grog_OH@Hotmail.com)
Date: 05/29/02


From: "Grog in Ohio" <Grog_OH@Hotmail.com>
Date: Wed, 29 May 2002 16:11:55 -0400


In a Windows NT domain, the security log of the PDC can be configured to
record that info. From User Manager for Domains, click "Policies", "Audit",
"Audit these events" and turn on auditing for "User and Group Management"...
Both "Success" and "Failure" will come in handy. Then review the Security
Event Log for the PDC for event ID 628.

Grog

"Scott" <alphainfinity2000@yahoo.com> wrote in message
news:82dc01c20749$ce5cf200$a4e62ecf@tkmsftngxa06...
> Hello all,
>
> I am responsible for about 300 workstations and I need to
> know how to setup auditing on the administrator account in
> a way that I will be notified when the password has been
> changed.
>
> At this point in time, we are still on a Windows NT
> domain, so I don't have any of the auditing tools
> available to AD administrators.
>
> It is very simple for a user to grab the standard linux
> disk and change the password, and I was wondering if there
> was a way for that workstation to notify me via email or
> some other means that the password has been changed?
>
>
> Suggestions?
>
> p.s. We are in the process of locking down the BIOS,
> disabling the floppy boot option ect ect....
>



Relevant Pages

  • Re: administrator sign on
    ... I dont' think Windows audits this by default. ... Event log in the Security log, in the Computer Management MMC. ... also audit success of, say, logon events, and probably also system events, ...
    (microsoft.public.security)
  • Re: Auditing or preventing task manager from terminating a process
    ... With that setting on, and the object audit enabled, I ... In addition to Files, Registry Keys, and Printers, Windows NT has a number ... introduce so many audit entries into the security log that locating real ... It generates a lot of audit events. ...
    (microsoft.public.win32.programmer.kernel)
  • Re: colon in item id to DOS directory
    ... Windows is simply rejecting the file update. ... Deleting an item with a colon in the id of a DOS directory leaves the 0 ... Say AUDIT is a super-Q pointer to a DOS directory. ... :LIST AUDIT ...
    (comp.databases.pick)
  • RE: Tracking File Modifications by User?
    ... Based on the information you provided, it should be a windows 2000 issue. ... you can enable Audit log in Event log to do so. ... locate the file or folder you want to audit. ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • RE: NT4 to Server 2003 Migration
    ... Windows 2003 but the new hardware will not support Windows NT 4.0. ... It will only be used as a transition server. ... | functions, too), 1 PDC, and a few member ...
    (microsoft.public.windows.server.migration)