Re: Security Event log full in 30 min

From: Blitz (jritchie@removehurricane-equipment.com)
Date: 01/21/03 

From: Blitz <jritchie@removehurricane-equipment.com>
Date: 21 Jan 2003 21:16:00 GMT

"Jeff" <jeff@nospam.com> wrote in
news:012801c2c18e$149e2320$d7f82ecf@TK2MSFTNGXA14:

>
> Okay, I'm attempting to remember what the settings are on
> W2k, but I believe they are similar to XP. There is an
> Audit Logon Events, which is what you set, and there is
> Audit Account Logon Event - which is what you want.
>
> Audit Logon Events should log everything, including system
> events.
>
> Audit Account Logon Events should only log actual account
> logons (like yours), not the system logon events.
>
> That's all from the depths of my brain, so forgive me if I
> do not have the exact syntax down of what the audit
> policies are actually named, but it should be close.
>
>

Bingo that was it. Acounts events. Thanks

Relevant Pages

  • Re: Get list of users who logged into Domain Controller?
    ... need to enable "Audit logon events" I suggest you also enable "audit account ... Both of these should be enabled on the domain controller policy. ... > Networks" was missing from the Network Properties. ...
    (microsoft.public.win2000.security)
  • Re: Monitor file system changes
    ... There is AD auditing, and then there's file system and other resource auditing. ... Audit logon events: Security Configuration Editor; ... If both account logon and logon audit policy categories are enabled, logons that use a domain account generate a logon or logoff event on ... ...
    (microsoft.public.windows.server.active_directory)
  • Re: Log-in log-out
    ... In addition to the policy already in place also enable the "Audit logon events" policy, you should then see Events 528. ... Audit account logon events will record events 680 and 681. ...
    (microsoft.public.win2000.general)
  • Windows 2003 (IIS6) security question
    ... If you enable auditing for "Audit Logon Events" or "Audit Account ... would be for a high traffic web server getting an essentail DOS attack ...
    (microsoft.public.inetserver.iis.security)
  • Re: monitor logon time
    ... Appears Audit logon events needs to be turned on also. ... The one you mention is ones the local security system authorised. ... Click on Local Policies/Audit Policies, ...
    (microsoft.public.windowsxp.general)