Re: Auditing of Printer Object Creation

From: Eric Fitzgerald [MSFT] (ericf_at_online.microsoft.com)
Date: 05/14/03

Next message: Eric Fitzgerald [MSFT]: "Re: Damaged registry/logon accounts!"
Previous message: brian: "Security Log Not recording Security events"
In reply to: Gussie Finknottle: "Re: Auditing of Printer Object Creation"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Wed, 14 May 2003 11:50:01 -0700

We don't audit object creation directly, only as a "create child" access on
the parent object. Since printers don't have an auditable parent object, we
can't audit their creation. We are considering object creation auditing for
a future release.

However, if informational logging is enabled, then Event ID 2 (source:
"Print") will be logged to the System log when a printer is created.

"Printers & Faxes" window: File/Server Properties, Advanced Tab, Log Spooler
Information Events.

Eric

-- 
Eric Fitzgerald
Program Manager, Windows Auditing and Intrusion Detection
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.
"Gussie Finknottle" <Gussie.Finknottle@BTInternet.Com> wrote in message
news:a8b6a528.0305120458.eea577b@posting.google.com...
> Guess that means no :-(
> G.
>
> Gussie.Finknottle@BTInternet.Com (Gussie Finknottle) wrote in message
news:<a8b6a528.0305070115.2ca2b67d@posting.google.com>...
> > Does anyone know if it's possible to audit the creation of a printer
> > on a W2k device?
> >
> > G.

Next message: Eric Fitzgerald [MSFT]: "Re: Damaged registry/logon accounts!"
Previous message: brian: "Security Log Not recording Security events"
In reply to: Gussie Finknottle: "Re: Auditing of Printer Object Creation"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]