Re: Admin Right

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 09/23/04 

Date: Thu, 23 Sep 2004 02:31:27 GMT

If you enable auditing of account management in the Domain Controllers Security
Policy an event will be recorded in the security log on one of the domain
controllers, probably Event ID 632. The same can be done for a local computer
security policy if this user was added to the administrators group on a domain
computer. Any administrator however can clear the security logs though that itself
will record an event with the user name that cleared the log. The link below goes
into a lot more detail on auditing if interested. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

"Controller" <anonymous@discussions.microsoft.com> wrote in message
news:37e601c4a074$c94fd7c0$a501280a@phx.gbl...
> We are 2 domain admins in the company, and one of us has
> assigned admin rights to one of the users and when I asked
> the domain admin he said he didn't so it.
>
> So is there anyways to discover who assigned admin right
> to that user?

Relevant Pages

  • Re: trace user logons
    ... Check to see what the "Effective Setting" is under the "Audit Policy" on one ... of your servers or workstations. ... i had several of the local audit policies enabled under Domain ... I've checked the filter on the security log, and it is set to show ...
    (microsoft.public.windows.server.security)
  • Re: GPO OBJECT ACCESS
    ... With the computer in your OU and when you run gpresult on that computer it ... Another thing to consider is that by default the security log ... I would also check the Local Security Policy on the computer you put into ... what is going on with Group Policy for a certain computer/user/OU/GPO. ...
    (microsoft.public.win2000.group_policy)
  • How do I read the Security Log
    ... Enable Auditing for Logon Events and Object Access ... This logs events in the security log informing you if IKE ... Using the Group Policy MMC snap-in, ... Enable success and failure auditing for "Audit logon ...
    (microsoft.public.win2000.security)
  • Re: Security log full
    ... Are the machines located in the OU where the policy is linked to? ... disabled the audit log from domain policy, ... What security log are you talking about, ... but some of the user stiil getting the security log full and ...
    (microsoft.public.windows.server.general)
  • Re: any help installing KB840374 yet?
    ... I just checked the setting for "Manage auditing and security log" and ... only the domain admins have this right (similar to adding workstations to a ... > I really recommend contacting your System Administrator. ... >> local admin rights on the machine. ...
    (microsoft.public.windowsupdate)
Quantcast