Re: Audit failures from explorer.exe
From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 03/08/05
- Next message: Steven L Umbach: "Re: Login/Logoff Information"
- Previous message: Galen: "Re: Anyone interested in getting Microsoft, CISCO or any other IT CertificationzzzZ...???"
- In reply to: Jan Bares: "Re: Audit failures from explorer.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 7 Mar 2005 21:00:46 -0600
The best way to see if Event Comb suits your needs is to try it out as it is
free. You can specify specific events to search for and then enter a text
string to search for within those events. --- Steve
"Jan Bares" <jan.bares@nospam.nospam> wrote in message
news:OFPS2IvIFHA.4060@TK2MSFTNGP14.phx.gbl...
> Thank Steven,
>
> does Event Comb support to filter out (don't show them) events from
> specific
> process ID? So I can filter out 560 events created by explorer?
> The problem is, that events doesn't contain name of executable, only
> process
> ID, so any filtering after explorer was restarted will not help.
>
> Jan
>
> "Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
> news:ONjG5WnIFHA.236@TK2MSFTNGP14.phx.gbl...
>> I have noticed the same thing and there is no way to selectively disable
>> auditing of explorer.exe. You might find that using Event Comb can help
>> to
>> filter security log searches to find more specific information and
>> events.
>> Event Comb allows you to search based on text strings and event ID's.
>
>
- Next message: Steven L Umbach: "Re: Login/Logoff Information"
- Previous message: Galen: "Re: Anyone interested in getting Microsoft, CISCO or any other IT CertificationzzzZ...???"
- In reply to: Jan Bares: "Re: Audit failures from explorer.exe"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
