Re: Event Viewer

From: Kenneth Bryant (kbryant_at_checksinthemail.com)
Date: 04/26/05 

Date: Tue, 26 Apr 2005 09:15:06 -0500

thank you.

"Steven L Umbach" <n9rou@nospam-comcast.net> wrote in message
news:uDX2EOgSFHA.3988@tk2msftngp13.phx.gbl...
> It all depends on your security policy and needs for your situation. At
bare
> minimum it is a good idea to enable in Domain Controller Security Policy -
> auditing of "account logon" events for success and failure, system events
> for success and failure, logon events for failure, account management for
> success and failure, and policy change for success and failure. For domain
> computers auditing of "logon" events for success and failure, system
events
> for success and failure, policy change for success and failure, and
account
> management for success and failure is a good idea. Make sure the size of
the
> security logs has been increased quite a bit from default. The link below
> should be helpful. --- Steve
>
>
http://www.microsoft.com/technet/security/prodtech/windows2000/secmod144.mspx
>
> "Kenneth Bryant" <kbryant@checksinthemail.com> wrote in message
> news:%23OHLYrdSFHA.2520@TK2MSFTNGP09.phx.gbl...
> > We are running Win2k With AD. Does anybody know what are the best
events
> > to
> > look for when tracking possible security breaches? Is there a website
> > that
> > has what event id's to look for?
> >
> > Thanks,
> >
> > Kenneth
> >
> >
>
>

Relevant Pages

  • Re: Event Viewer
    ... It all depends on your security policy and needs for your situation. ... minimum it is a good idea to enable in Domain Controller Security Policy - ... auditing of "account logon" events for success and failure, ...
    (microsoft.public.win2000.security)
  • Re: Auditing Workstation logons from DC
    ... > well as interactive directly into the Domain Controller itself. ... > Settings for Audit account logon to Success and Audit logon events to ... I have Domain Controller Settings to audit account logon to ... > and Failure and Audit Logon to Success and Failure. ...
    (microsoft.public.security)
  • Re: Default Domain Policy vs Default Domain Controller Policy
    ... > for both success and failure in Domain Controller Security Policy. ... > domain controller points ONLY to itself as it's preferred dns server by it's ...
    (microsoft.public.cert.exam.mcse)
  • Tracking logon and logoff activity
    ... Audit account logon events (Success, Failure) does not ... The domain 2000 security Policy is configured properly. ...
    (microsoft.public.win2000.security)
  • Re: logging
    ... In Local Security Policy look at the "effective settings" to see what they ... > At first I checked success and failure. ...
    (microsoft.public.win2000.security)