Security

Ask something
Discussion Locked

Event and process ID in NT 4.0

0 helpful
2 replies

by benb3

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Help, I have an internal security problem and am in need of a key listing of the event and process ID's reported in NT 4.0 event viewer. I recently had the application log cleared on our exchange server, Obviously by someone holding admin Rights.This is also Obviously a cover up of privliaged use activity on an Exchange 5.5 server. Is the clearing of the event logs recorded/tracked if auditing is set to log process tracking?

Where may I find a key to the process and event ID's reported in event viewer?? Technet does not have it...
Thanks!

2 replies

by mc cunningham

If you have auditing "enabled" on the Exchange Server...

1. Goto the Event Viewer,
2. Switch to the "Security" Log,
3. Scroll to the bottom of the log
[Earliest Entries]
4. Look for Event Code 517 (System Event)
or Event Code 578(Priviledge Event)

Upon opening the "517" events... look for a description in the top line that indicates "The Audit Log was Cleared", if found the "Client User Name" will also be listed, and you have your Admin!

If you don't see a "517" Event, you can check for "578" Events. The "Client User Name" associated with this event isn't as "Fullproof" as the 517 Event, but it could give an indication as to what users were working on the machine when the logs were "reset".

If the "Auditing" wasn't enabled, I would go in to "User Manager" (Policies/Audit) and start auditing for future problems. This is also why it is a good security practice (IMHO) not to share Admin Accounts/Passwords with others-so that if something like this happens there will be accountability as to who did what.

Hope that helps...

by vino_mk

You can try this in the control pannel-services.
I think this will solve your issue.
Bye..vinod

This discussion is closed to new replies.