Security

Ask something
Discussion Locked

Network Security

0 helpful
3 replies

by psyhco

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ihave question about the security log. With all auditing turned on in a
Windows NT 4.0 domain. Will a computer show up in the security log of another
computer if they only accessed the computer by the network neighborhood.
Only going as far as looking at what is shared. This is very important question I need
help with.

3 replies

by joseph moore

The Security log auditing of Logon Events is triggered anytime a client connects to the audited machine.
So, if you have Successful logons audited, then everytime a user tries to connect to the server, a record will be written.
This does include double-clicking on a Shared folder, making a drive mapping, even double-clicking on the server in Network Neighborhood.
If you have a logon script that maps a drive to the server, this will be logged.
If a person types in \\MACHINENAME in the Start-> Run box (where MACHINENAME is the name of the server that is auditing), that will generate an alert.
Accessing a shared printer will generate a log.
Basically from a user perspective, anytime they touch the server in any way, it will generate alog event.
Now, just opening Network Neighborhood and seeing all of the servers in your domain will NOT generate a log. But, if a user double-clicks this audited server, that will write an event.

by joseph moore

Now, I do not like auditing Successful events. They just clutter up the log with stuff I don't cate about. I like to audit Failed logon events only. Those are the useful ones. So, if BOB tries to access \\MACHINENAME and you have the server configures so that BOB can't even view its shared folders, then BOB would get an access denied error and you would get a record (probably a few of them) in the Security log.
If you only deny BOB access to a shared folder, then BOB could do a \\MACHINENAME and not get an error (which means no event for you), but if BOB double-clicks on this restricted folder, then BOB would get the access denied error and you would have an event in the log.

hope this helps

by psyhco

This was a fast and accurate response. I have found a whole lot of information here.

This discussion is closed to new replies.