Re: audit
From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 11/17/04
- Next message: Steven L Umbach: "Re: Having multiple domain controllers does not help"
- Previous message: techguru100 (A+): "RE: Grant user exclusive rights to My Documents - Enabled"
- In reply to: DC Gringo: "audit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Tue, 16 Nov 2004 23:40:53 GMT
That indicates that user1 successfully exercised some user rights.
Particularly looks like that user did a backup and or restore operation.
Auditing of privilege use displays when a user used or attempted to use a
user right. The user rights for a computer are shown in the Local Security
Policy under security settings/local policies/user rights. For Windows 2000
the effective user right may differ from the local setting if the computer
is a domain member. --- Steve
"DC Gringo" <dcgringo@visiontechnology.net> wrote in message
news:%23kVGpEAzEHA.3908@TK2MSFTNGP12.phx.gbl...
>I audit to logons...can someone tell me what they mean?
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Privilege Use
> Event ID: 576
> Date: 11/15/2004
> Time: 5:02:22 PM
> User: domain\user1
> Computer: machinename
> Description:
> Special privileges assigned to new logon:
> User Name:
> Domain:
> Logon ID: (0x0,0xE15B34)
> Privileges: SeChangeNotifyPrivilege
> SeBackupPrivilege
> SeRestorePrivilege
> SeDebugPrivilege
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> Event Type: Success Audit
> Event Source: Security
> Event Category: Privilege Use
> Event ID: 578
> Date: 11/15/2004
> Time: 5:02:22 PM
> User: domain/user1
> Computer: CIL-132
> Description:
> Privileged object operation:
> Object Server: SC Manager
> Object Handle: -312443664
> Process ID: 1068
> Primary User Name: machinename$
> Primary Domain: domainname
> Primary Logon ID: (0x0,0x3E7)
> Client User Name: dheckel
> Client Domain: domainname
> Client Logon ID: (0x0,0xE15B34)
> Privileges: SeTakeOwnershipPrivilege
>
> For more information, see Help and Support Center at
> http://go.microsoft.com/fwlink/events.asp.
>
>
> --
> _____
> DC G
>
>
- Next message: Steven L Umbach: "Re: Having multiple domain controllers does not help"
- Previous message: techguru100 (A+): "RE: Grant user exclusive rights to My Documents - Enabled"
- In reply to: DC Gringo: "audit"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
