Re: Auditing / Event Log Entries...

From: Ketta (no_at_post.net)
Date: 10/04/04 

Date: Mon, 4 Oct 2004 15:45:20 -0400

I should probably mention I created a text file and then deleted it,
expecting that to show up as an entry in the security event log.

"Ketta" <no@post.net> wrote in message
news:uoCWgokqEHA.3252@TK2MSFTNGP14.phx.gbl...
> Hi,
> I enabled auditing through domain controller policy and then set audit
> on success / failures for everything under C:. I only want to audit one
> users activity through the entire system when they login to the domain
> controller. Nothing shows up in the event log even though it is enabled.
I
> have never used auditing before, but it looked pretty straight forward.
>
> 1. Enable auditing in the policy
> 2. Enable auditing on the security tab of choice
> 3. Watch the audit logs flow.
>
> TIA if anyone wants to educate me
>
> Ketta
>
>

Relevant Pages

  • RE: Internet connection stops responding two
    ... I am having the exact same problem, desktop dell with wireless connection - I ... > I get one error in the System Event Log and three in the Security Events Log ... > Security Event Log ... IPSec Services could not be started. ...
    (microsoft.public.windowsxp.network_web)
  • Internet connection stops responding two
    ... Running XP SP2 On a Dell Dimension 8200 with Dial-up connection. ... I get one error in the System Event Log and three in the Security Events Log ... The IPSEC Services service terminated with the following error: ... Security Event Log ...
    (microsoft.public.windowsxp.network_web)
  • Auditing Logon Failures for Win2K clients in a NT Domain
    ... From the old security logs prior to the workstation ... If the Win2K user mistypes the password enough times to lock out his ... security event log does show a 529 error, but I really want the error ...
    (microsoft.public.win2000.security)
  • RE: Windows Event Logs
    ... I use Snort to catch the IP/data packets from ... Monitoring these ports catches connection attempts that don't even ... haven't had a failed event log entry since the day of 7,000 attempts. ... relying on the Security Event Log is like relying on ...
    (Focus-Microsoft)
  • Re: Auditing at the files level
    ... And I have logging enabled on the local folder. ... >Did you enable auditing via the Local Security Policy? ... >> Where should the event log entries be displayed? ... >In the event log, but you have to 1) enable auditing on ...
    (microsoft.public.win2000.security)