Re: Dummy Administrator Account

From: Michael [MS] (a-miche@microsoft.com)
Date: 06/19/02 

From: "Michael [MS]" <a-miche@microsoft.com>
Date: Wed, 19 Jun 2002 12:11:20 -0700

You will also want to audit for successes and object accesses. That way you
will know if someone actually gets in and trys to grab something. Also make
sure you give this acount the absolute bare minumum of permissions (put them
in the Guest group). 

--
Michael Eisenhart
Microsoft Support Professional
Get Secure!! www.microsoft.com/security
"Steve" <SteveM@nospam.com> wrote in message
news:e7f401c217a7$c2414570$37ef2ecf@TKMSFTNGXA13...
> Hello everyone.  I have heard that it is a good idea to
> set up a dummy Administrator account and audit access.
> What is the best way to do that?  I have made a regular
> user account and called it Administrator.  I have enabled
> logging on all failed logon attempts.  Is there anymore
> logging or anything else I should do?  Thank you all in
> advance.

Relevant Pages

  • Re: Dummy Administrator Account
    ... > You will also want to audit for successes and object accesses. ... >> set up a dummy Administrator account and audit access. ... >> logging on all failed logon attempts. ...
    (microsoft.public.win2000.security)
  • RE: [fw-wiz] what to turn on for solaris auditing
    ... e.g. we must turn on logging for all commands executed by root. ... > But have yet to identify what are the information to turn audit on. ... put it under some load--or roll out your desired auditing configuration ... performance without really enhancing system security. ...
    (Firewall-Wizards)
  • RE: Audit Trail help - Passing values to audit table.
    ... You are wanting to insert two rows into the audit table, one for Joe, one ... fOSUserNameis a function that is commonly used to grab the users network ... What I mean by acting the same for an Insert is on an Insert, I need my audit ... Consider instead using an active/inactive flag. ...
    (microsoft.public.access.modulesdaovba)
  • Re: IDS on PIX 506e
    ... logging trap informational ... ip audit attack action alarm ... interface that the ip audit command is applied to? ...
    (comp.dcom.sys.cisco)
  • RE: Audit Trail help - Passing values to audit table.
    ... What I mean by acting the same for an Insert is on an Insert, I need my audit ... you really deleting records, so its not like there will be tons of them. ... then grab the actual name of the field, then grab the new value put in, and ... Consider instead using an active/inactive flag. ...
    (microsoft.public.access.modulesdaovba)