audit failed access

From: CEDRIC (cedric.bouchon_at_egger.com)
Date: 09/30/03

  • Next message: Ray: "Restrict user change the TCP/IP setting (Please Help)" 
    Date: Tue, 30 Sep 2003 01:11:01 -0700

    Thanks for your answer... i have 150 users's directory and i want to audit failed access on these directory and succesful permission change.
    When i enable auditing of object access on Local security Policies for FAILED and on object enbale FAILED for read write > No problem only failed access of users appear

    When i enable auditing of object access on Local security Policies for SUCCESS and on object enbale SUCCESS for permission change > Lot off event of the user "NT AUTHORITY\SYSTEM" with ID 560 and 562.

    My problem is that i have write a script and put this script in service to look permanently eventlog to send a mail alert if event id 560 and 612 appear. I doesn't want to disable on object audit everybody for the security i want to now if anyone try to access on these directory. After one week of research i begin to now what it's a bug or a forget on W2K because i have try to XP and no problem.

    Thanks for your help,
    Cedric

  • Next message: Ray: "Restrict user change the TCP/IP setting (Please Help)"

    Relevant Pages

    • auditing of object access
      ... succesful permission change. ... When i enable auditing of object access on Local security ... write> No problem only failed access of users appear ... Policies for SUCCESS and on object enbale SUCCESS for ...
      (microsoft.public.win2000.security)
    • audit success access
      ... succesful permission change. ... When i enable auditing of object access on Local security ... write> No problem only failed access of users appear ... Policies for SUCCESS and on object enbale SUCCESS for ...
      (microsoft.public.win2000.security)