Re: Help with Security Audits
From: Jeremiah Beckett (JeremiahBeckett_at_discussions.microsoft.com)
Date: 06/02/05
- Next message: Magoo: "Win Integ Auth, dilema on 'pop up' generated by SSL cert"
- Previous message: tharcleroad_at_taconichills.k12.ny.us: "Group policy to disable network hyperlinks in Word"
- In reply to: Steven L Umbach: "Re: Help with Security Audits"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Thu, 2 Jun 2005 13:28:04 -0700
Check out the new System Controls MP from Manakoa. It provides auditing
guidance and base collection of key security events that might be useful for
future monitoring of your systems.
http://www.manakoa.com/products/scmp/
"Steven L Umbach" wrote:
> Check to see if there is a local user account by that name on the server.
> The command net users would be a quick way. For a domain computer, domain
> accounts could also be used to attempt access. When you say profile I don't
> know if you mean user account or user profile as the term seems to be
> interchanged a lot. A profile will not be created until the user logs onto
> the computer at the console or via TS. If that computer should not be
> offering network shares then disable file and print sharing on it or modify
> the user right for access this computer from the network to include only the
> users/groups that should be accessing shares on the computer. It would also
> be a good idea to have auditing of account management enabled to see if
> unauthorized user accounts are being created/deleted. --- Steve
>
>
> "WP" <WP@discussions.microsoft.com> wrote in message
> news:7921EF0D-005C-4A69-B3EF-54DAE1B11FE0@microsoft.com...
> >I have a win2k terminal server with citrix installed
> > I have auditing setup on this server for successful and unsuccessful logon
> > events
> > In my event viewer I have this
> >
> > Event Type: Success Audit
> > Event Source: Security
> > Event Category: Logon/Logoff
> > Event ID: 540
> > Date: 6/1/2005
> > Time: 6:36:40 AM
> > User: RMH\ecoombs
> > Computer: RMH-CITRIX-1
> > Description:
> > Successful Network Logon:
> > User Name: xxxxxxx
> > Domain: xxxxx
> > Logon ID: (0x0,0xE5CD350)
> > Logon Type: 3
> > Logon Process: NtLmSsp
> > Authentication Package: NTLM
> > Workstation Name: xxxxxxxx
> > This user doesnt show a profile on the server so I am wondering how to
> > track
> > down what type of activity it was
> > This user shouldnt be accessing this server
> > Thanks in advance
> >
>
>
>
- Next message: Magoo: "Win Integ Auth, dilema on 'pop up' generated by SSL cert"
- Previous message: tharcleroad_at_taconichills.k12.ny.us: "Group policy to disable network hyperlinks in Word"
- In reply to: Steven L Umbach: "Re: Help with Security Audits"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
