Re: Audit and application's execution

From: Steven Umbach (n9rou_at_comcast.com)
Date: 09/17/03 

Date: Wed, 17 Sep 2003 16:20:44 GMT

You can enable auditing of object access and then set auditing of the executable
in properties/security/advanced/auditing/execute file. However that may not give
you a closing time - you will need to test it out, and try to use minimum amount
of groups or users to audit instead of everyone to keep events generated down.
You could also enable auditing of process tracking, however that will generate
huge amounts of events in your security log for that computer. You also will
want to substantially increase the size of the security log from default. ---
Steve

"Sebas" <test@test.com> wrote in message
news:eW$kVGTfDHA.2748@TK2MSFTNGP11.phx.gbl...
> Hi,
>
> I'd like to audit on a W2000 workstation if an application
> was used - opening and closing time.
>
> I know it's possible to audit a service this way.
>
> how can I do the same with an app?
>
> Thanks
>
> Sebastien
>
>

Relevant Pages

  • Re: log file how to?
    ... You can enable auditing on your computers however for what you would want to do you ... would need to audit everything and then enable auditing on all folders on the ... events in the security log and use Event Comb to scan the logs of multiple computers. ...
    (microsoft.public.win2000.networking)
  • Re: [Question] Audit Share
    ... You can enable auditing of object access and then enable auditing of folders/files, ... however a lot of events will be generated in the security log. ... > Is it possible to audit the Share. ...
    (microsoft.public.win2000.security)
  • Re: How do I monitor file access rights on Win2003?
    ... To get audit information logged about NTFS objects you need to ... both enable auditing of object access and also set the SACL (the ... Audit tab in the NTFS security dialog) on what should be subjected ...
    (microsoft.public.windows.server.security)
  • Re: Auditing Logons and Logoffs
    ... enable auditing of "account logon" events. ... will logon to their domain computer but unfortunately not when they logoff. ... domain controllers shows only events when domain users and computers access ... security log of the computer that has the share you are auditing. ...
    (microsoft.public.win2000.security)
  • Auditing / Event Log Entries...
    ... I enabled auditing through domain controller policy and then set audit ... Enable auditing on the security tab of choice ... Watch the audit logs flow. ...
    (microsoft.public.win2000.security)