Re: Auditing on a member server

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 11/10/05 

Date: Wed, 9 Nov 2005 23:04:53 -0600

Look in Local Security Policy [secpol.msc] to make sure that it shows
auditing is enabled as you expect. For Windows 2000 computers look at the
"effective" setting. Sometimes you need to either reboot the computer or
refresh the Group Policy change manually with gpupdate /force [XP/2003] or
secedit /enforce [W2000] to get the GP change to apply. If you are auditing
folders or files you also need to enable auditing of object access first. If
in doubt of what Group Policies are applying to the computer run the support
tool gpresult to find out which will also show the last time the policy was
applied and from what domain controller. Also look in the application log
for any errors or warning for userenv or scecli which could indicate that
Group Policy is not being applied from the domain/OU level. --- Steve

"NewsGr" <Ciava@nospam.net> wrote in message
news:%23%23EyuxW5FHA.3296@TK2MSFTNGP09.phx.gbl...
> We have auditing set at AD to audit certain failures and success events,
> but at a local server we cant get the auditing to log to security log any
> auditing events we put in the directory. I tried auding all
> success/failure for a certain group, and logged in as a memebr of that
> group but nothing gets audited to sec log. Im a bit rustry on this so
> any tips appreciated. Also, Our audit policy allows the security log to
> get up to 16 meg and it is under 1 meg.
>
> thanx
>
> CR
>
> --
> http://QLiner.com
>
> Dilbert's Words of Wisdom: My Reality Check bounced.
>
>

Relevant Pages

  • Re: Detail display for audit policy
    ... manipulating with security such as Scriptlogic's Security Explorer ... are talking about auditing I would suggest using Active Administrator ... If I want to audit the user permission. ... auditing through Group Policy, you can enable it in each server's Local ...
    (microsoft.public.windows.server.security)
  • Re: Who last saved a file?
    ... Turn on Audit Policy thru either: ... Local Security Policy - on each file server or ... Set auditing on partcicular folder. ...
    (microsoft.public.windows.server.general)
  • Re: Auditing object access
    ... Local Security Policy will be overridden by Domain/OU/or Domain Controller Security ... Enabling auditing on folders will generate tons of events. ... and audit only what permission you want to track. ...
    (microsoft.public.win2000.group_policy)
  • RE: Win2K Advanced Server
    ... Security events only get logged when you enable Auditing. ... Security Policy by expanding the Local Policies tab, ...
    (microsoft.public.win2000.setup)
  • RE: filenames changing
    ... Mal is right, let's turn on file auditing, and troll the security log ... the server resides, right-click on it and click Properties. ... On the Group Policy tab, select a GPO and click Edit (if there's no GPO ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)