Re: Auditing changes in Regional Options

From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 05/07/03 

Date: Tue, 6 May 2003 18:13:02 -0700

It's stored in the registry, but I don't know exactly where. You can
probably find it with NTRegmon (www.sysinternals.com, free download), and
then set auditing for everyone:set value:success on that registry key and
enable object access success audit policy.

Eric 

-- 
Eric Fitzgerald
Program Manager, Windows Auditing and Intrusion Detection
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"Hein Olivier" <hein.olivier@ast.co.za> wrote in message
news:06ea01c313d1$113f2770$a601280a@phx.gbl...
> Hi there,
> I've got a problem with a users W2k PC where the Short
> date format changes from yyyy/mm/dd to mm/dd/yy (in the
> Regional Settings) at a random time during non-working
> ours. Even if we correct the date format the problem
> reappears after a time. I'm would like to audit/monitor
> the changes and try to find out the cause of this change.
> I'm not sure what audit policy to use or how to set it up
> to look for this specific change. Any suggestions in how I
> must go about and audit this change?
> Thanks