Re: Auditing / Event Log Entries...

From: GX (GX_at_DOMAIN.com)
Date: 10/07/04 

Date: Thu, 07 Oct 2004 15:30:47 GMT

Steve,

Let me stay on the same subject here...
Question: If you enable Object Access on Domain Controller (DC1SVR) to be
audited, how can you tell that the file (test.txt) under the machine
WINXPPRO24 > C:\Documents and Settins\John.Doe\My Documents\My Test Files
was accessed by the user Mary Jane?

Do you have to enable the Auditing on that specifi folder on the remote
machine or can you do it from the DC?

Thanks
GX

"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:oQk8d.119482$wV.11272@attbi_s54...
> You will have to enable auditing of object access on the computer where
> you want to track object access for folders/files. If you enable in Domain
> Controller Security Policy it will record only files on domain controller
> that the user accesses. If you want to enable in on multiple computers you
> will have to enable it at the domain or Organizational Unit level. Look
> for event ID's 560 and 562 in the security logs of the computer or domain
> controller that the user accesses. --- Steve
>
> http://www.microsoft.com/technet/security/guidance/secmod144.mspx --
> great white paper on auditing
>
> "Ketta" <no@post.net> wrote in message
> news:uoCWgokqEHA.3252@TK2MSFTNGP14.phx.gbl...
>> Hi,
>> I enabled auditing through domain controller policy and then set audit
>> on success / failures for everything under C:. I only want to audit one
>> users activity through the entire system when they login to the domain
>> controller. Nothing shows up in the event log even though it is enabled.
>> I
>> have never used auditing before, but it looked pretty straight forward.
>>
>> 1. Enable auditing in the policy
>> 2. Enable auditing on the security tab of choice
>> 3. Watch the audit logs flow.
>>
>> TIA if anyone wants to educate me
>>
>> Ketta
>>
>>
>
>

Relevant Pages

  • Re: Audit Object Access
    ... If you want to audit just a specific domain controller you ... object access so that it will not override local policy. ...
    (microsoft.public.win2000.security)
  • Re: Auditing Account management events
    ... Simply enable auditing of "account management" in the ... security policy of the computer where you want to track these events. ... are tracking events for domain users, enable auditing of account management ... in Domain Controller Security Policy and view the security logs of the ...
    (microsoft.public.win2000.group_policy)
  • Re: auditing logging on
    ... of security policy for a domain controller is in the Domain Controller Security ... >> logs for failed events after you enable auditing for it. ...
    (microsoft.public.win2000.security)
  • Re: Folder Audit
    ... Make sure you follow Doug's instructions on enabling auditing of object access at the ... "domain controller" level which would by default be Domain Controller Security ... Local Security Policy on the domain controller and view the auditing settings where ...
    (microsoft.public.win2000.networking)
  • Re: Windows 2000 Domain Auditing
    ... If you enable auditing for the domain, then you enabled it for all machines ... To audit domain logons, enable auditing ... at least for account log on in the Domain Controller Security Policy. ...
    (microsoft.public.win2000.security)
Loading