Re: Question on Audit Policy

From: Steven L Umbach (n9rou_at_attbi.com)
Date: 07/07/03 

Date: Mon, 07 Jul 2003 00:16:43 GMT

         See link to KB article to answer your question. Auditing is set at
domain controller policy level. I believe by default, all objects are
configured to be audited for the everyone group [in contrast to object
access auditing where you have to enable auditing for file/folder, etc.] ,
but you can change that. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314955

"TC" <tc@t.co.in> wrote in message
news:6a3401c34393$4e98dc00$a401280a@phx.gbl...
> Just had a question on audit policy
> Newbie to Active directory
>
> I was wondering - when I enable auditing in the Domain
> security policy for Audit directory service access
>
> does the system audit access to every single object in AD
> by default if it does how can one only audit what one
> needs.
> OR By default the system does not audit anything until I
> specify on the object that It needs to be audited.
>
>
> Thanks
> TC

Relevant Pages

  • Re: audit object access failure.
    ... If you're a member of a domain, make sure that domain policy isn't ... auditing for the user that you wish to audit on this object. ... > Audit account logon events ...
    (microsoft.public.win2000.security)
  • Re: HELP - File Auditing
    ... > We have performed all of the below on many servers with no results... ... Auditing must be enabled on ... > individual objects for audit events to be logged. ... >>audit policy setting take effect only when the policy ...
    (microsoft.public.win2000.security)
  • RE: Enabling Auditing for files and folders
    ... > I understand that you want to audit files and folders on SBS 2K3, ... > have created "Local Computer Policy" in Group Policy Object Editor. ... Now you are in the Default Domain Controller Security Setting. ... Go to Security tab, click Advanced, go to Auditing Tab. ...
    (microsoft.public.windows.server.sbs)
  • Re: HELP - File Auditing
    ... We have performed all of the below on many servers with no results... ... Enabling either success or failure event auditing does ... individual objects for audit events to be logged. ... >audit policy setting take effect only when the policy ...
    (microsoft.public.win2000.security)
  • Re: Print Auditing
    ... Setup auditing on the Print Queue itself. ... Only configure successful writes to the queue, ... > Event Type: Success Audit ... >>> administrator to turn on auditing using Group Policy Editor. ...
    (microsoft.public.windows.server.security)