Re: Kerberos event logging (LogLevel registry value)

From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 04/29/03

  • Next message: Eric Fitzgerald [MSFT]: "Re: Auditing File Access - SYSTEM" 
    Date: Mon, 28 Apr 2003 15:22:30 -0700

    LogLevel refers to Kerberos logging in the SYSTEM log, and has nothing to do
    with the Account Logon events in the Security log. 

    -- 
Eric Fitzgerald
Program Manager, Windows Auditing and Intrusion Detection
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"Jean-Baptiste Marchand" <jbm+news@glou.net> wrote in message
news:slrnbafkkr.1eq.jbm+news@gwyneth.glou.net...
> Hello,
>
> MSKB #262177 describes how to enable additional Kerberos event logging
> in the System log. The technical reference to the Windows 2000 registry
> says that, once this value is set to 1, ticket requests are recorded in
> the event log (this is probably an incorrect description because
> security events 672 (Authentication Ticket Request) and 673
> (Service Ticket Request) appear in the Security log, once the Account
> Logon events auditing category is enabled).
>
> When LogLevel is set to 1, the only events recorded in the System log
> with Source = Kerberos have 3 as identifier and are only errors,
> apparently caused by a mechanism running every 15 minutes.
>
> Does anyone know what LogLevel is supposed to enable?
>
> Thanks for your help,
>
> Jean-Baptiste Marchand
> -- 
> jbm@glou.net
> Real Unix Books are written with Troff
> (W. Richard Stevens)
  • Next message: Eric Fitzgerald [MSFT]: "Re: Auditing File Access - SYSTEM"

    Relevant Pages

    • Kerberos event logging (LogLevel registry value)
      ... MSKB #262177 describes how to enable additional Kerberos event logging ... security events 672 (Authentication Ticket Request) and 673 ... When LogLevel is set to 1, the only events recorded in the System log ... Does anyone know what LogLevel is supposed to enable? ...
      (microsoft.public.win2000.security)
    • Re: Boot problems - How to debug / see an error message ?
      ... I would look in the System log and not the Security log. ... > up or this current successful boot up: ... > Alerter service, although I have so far failed to understand it. ...
      (microsoft.public.windowsxp.perform_maintain)
    • Re: XP SP2: cannot access Disk Manager (LDM) on remote Win 2000 s ystems>>>
      ... Check the System log ... System Log has Event ID 4 from Kerberos: ... Subject: XP SP2: cannot access Disk Manager on remote Win 2000 ... This email has been scanned by the MessageLabs Email Security System. ...
      (NT-Bugtraq)
    • Re: WINS could not start - Problem with logs
      ... The security log is full of Success Audit events ... >> Reading the system log is a problem. ... In management console reading the ... Clicking on the invisible list shows some events are empty ...
      (microsoft.public.backoffice.smallbiz2000)
    • Re: Group Policy / Kerberos problem - policy not applied
      ... motherboards with SIS900 NICs. ... The following even appears in the System log (source Kerberos, ... The kerberos subsystem encountered a PAC verification failure. ...
      (microsoft.public.windows.group_policy)