Can users that reboot a server be tracked?

From: cfanetworks (cfa_at_cfanetworks.com)
Date: 05/17/04

  • Next message: Marin Marinov: "Re: auditing question" 
    Date: Mon, 17 May 2004 14:16:15 -0400

    I have 2 servers in the domain that are rebooting for some unknown reason.
    I need to find a way to track what user is rebooting the server. It does
    not reboot over the weekend so I am assuming that there is a user
    maliciously rebooting the server. Can it be tracked?

    Jon Skelley

  • Next message: Marin Marinov: "Re: auditing question"

    Relevant Pages

    • Re: 5.3 spontaneously rebooting
      ... my server has been rebooting itself for an ... > unknown reason. ...
      (freebsd-questions)
    • Re: HELP! Ive been had! Someone hacked into my Linux box. What now?
      ... server that is using a default sshd configuration. ... As of now it is still rebooting at 9:00 AM. ... been "rootkitted" (the standard way of hijacking a server). ... Rootkits ...
      (comp.os.linux.security)
    • Re: Troubleshoot Failing Clients Internet Connection
      ... rebooting no problems with clients connecting to the interner on Tuesday and ... I plan to remove the card this weekend. ... How many nics in your SBS server? ... Internet when they first logon in the morning. ...
      (microsoft.public.windows.server.sbs)
    • Re: save and sound operating system
      ... One is a short-term solution. ... totally automatically, just rebooting a workstation ... but a stand-alone server (especially Web ... operating system. ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Help, MS tech support is useless
      ... You need to troubleshoot now and as you go along turn on the services one by ... > It is a DNS server as well. ... > Basically any DC that I install the sp on, craps out once it is rebooted. ... AFter rebooting the server takes forever ...
      (microsoft.public.windows.server.general)