Security

Ask something
Discussion Locked

Auditing Account Changes

0 helpful
5 replies

by p.lockwood

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Is there a way to track / audit changes in a NT user's account and who did them? I would like to track all aspects of an non-privileged account. i.e. Group modifications, profile changes.

5 replies

by timwalsh

In User Manager for Domains, open the Policies menu and choose Audit.

Check the box titled "Audit these events."
Check both the "Success" and "Failure" boxes next to "User and Group Management" and "Security Policy Changes." Auditing of User and Group Management events will log changes to Group membership, and other settings for individual accounts. Auditing of Security Poicy Changes will log global changes to password policies, user rights, etc.

Be advised that this enables auditing for ALL user accounts. There is no way (native to Win NT anyway) to enable auditing only on specific accounts.

by gigelul

Also verify the Event log settings about and .For a long time of audit export periodicaly these events.

by gigelul

If you are in network enviroment you can implement a Policies which allow you to restrict the use of specific applications.

This discussion is closed to new replies.