Failure audit in security log

From: AiKay (iwazeer2@hotmail.com)
Date: 10/31/02

Next message: Steve H: "Certificate Roaming problems"
Previous message: Steve: "Re: Certificate Roaming"
Next in thread: Eric Fitzgerald [MS]: "Re: Failure audit in security log"
Reply: Eric Fitzgerald [MS]: "Re: Failure audit in security log"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

From: "AiKay" <iwazeer2@hotmail.com>
Date: Thu, 31 Oct 2002 10:28:44 -0500

I saw some Failure audits in my security log with Event Code Ids 529 and
681. The log (in event viewer) only shows a workstation name in the
Workgroup domain. Is there anyway I can find out more information about that
workstation or try to gather more information that will be useful for my
network security person?

Aikay

Next message: Steve H: "Certificate Roaming problems"
Previous message: Steve: "Re: Certificate Roaming"
Next in thread: Eric Fitzgerald [MS]: "Re: Failure audit in security log"
Reply: Eric Fitzgerald [MS]: "Re: Failure audit in security log"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

a forensic question
... A user swore that she had powered down her NT 4.0 workstation before going ... The Event Viewer | Security Log, there was no entry as auditing was not ... The Event Viewer | System Log, the PC was powered down at 5:15 pm yesterday ...
(comp.security.misc)
a forensic question
... A user swore that she had powered down her NT 4.0 workstation before going ... The Event Viewer | Security Log, there was no entry as auditing was not ... The Event Viewer | System Log, the PC was powered down at 5:15 pm yesterday ...
(microsoft.public.win2000.security)
Re: a forensic question
... > A user swore that she had powered down her NT 4.0 workstation before going ... But she discovered that some important files on her workstation ... > The Event Viewer | Security Log, there was no entry as auditing was not ... > security log of the PDC? ...
(microsoft.public.win2000.security)
Re: a forensic question
... the last 12 years that a user "swore the file was there" or "swore someone ... But she discovered that some important files on her workstation ... > The Event Viewer | Security Log, there was no entry as auditing was not ... > security log of the PDC? ...
(comp.security.misc)
Re: a forensic question
... > A user swore that she had powered down her NT 4.0 workstation before going ... But she discovered that some important files on her workstation ... > The Event Viewer | Security Log, there was no entry as auditing was not ... > security log of the PDC? ...
(comp.security.misc)