Auditing

From: Bryce Shaw (bryce@silicon-wafers.com)
Date: 08/29/02

Next message: karl [x y]: "Re: Folder Security, I have a problem!"
Previous message: spectre1952: "Re: Nero Access Rights"
Next in thread: krish shenoy[MS]: "Re: Auditing"
Reply: krish shenoy[MS]: "Re: Auditing"
Reply: Tim Hines, MCSE: "Re: Auditing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: "Bryce Shaw" <bryce@silicon-wafers.com>
Date: Thu, 29 Aug 2002 12:05:44 -0400

Hi Everyone,

It seems I'm having a problem setting up auditing. I had previously set up
account lockout after 3 bad hits....you know....to help keep the bad guys
out. And two people on my network keep having their accounts tripped. So I
tried to set up Logon/Off auditing. I open the MMC for Domain Security
Policy and expanded "Local Policies" and expanded "Audit Policy" and then I
set Audit account logon events to Success, Failure.

And from what I know, I thought that was all I had to do, but my security
log is still empty. Am I missing a step or something?

Thanx for any help,
Bryce Shaw

Next message: karl [x y]: "Re: Folder Security, I have a problem!"
Previous message: spectre1952: "Re: Nero Access Rights"
Next in thread: krish shenoy[MS]: "Re: Auditing"
Reply: krish shenoy[MS]: "Re: Auditing"
Reply: Tim Hines, MCSE: "Re: Auditing"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Re: Account Lockout
... Enable auditing and look for lockout ... From the lockout events, determine which clients they originate from. ... >>> Do this via a GPO and watch for failed logon attempts. ... I have a user's account that is getting ...
(microsoft.public.win2000.active_directory)
Re: Account Lockout
... Enable auditing and look for lockout events. ... >> Do this via a GPO and watch for failed logon attempts. ... I have a user's account that is getting ...
(microsoft.public.win2000.active_directory)
Re: Account disapears
... This KB explains how to turn on Active Directory auditing in Windows Server ... on the auditing policies for Windows Server 2003 we find the Account ... success events to detect the deletion in Windows 2000. ...
(microsoft.public.win2000.active_directory)
Re: FSO to non domain server UNC?
... as long as there is an IUSR or IWAM account in both domains [or ... There should definitely be auditing events. ...
(microsoft.public.inetserver.iis.security)
Re: Account Lockout
... I have the auditing turned on. ... I have a user's account that is getting locked ... >> I don't want to have to search the security event logs from all the ... >> computers and servers on our network. ...
(microsoft.public.win2000.active_directory)