Security Log Question

This method should help you out.
On the Win2K Professional Resource Kit cd (it might also be on the Win2K Server Resource Kit, but I am not sure), in the APPS folder, there are several 3rd party applications.
One of them is the CyberSafe Log Analyst.

This MMC snap-in can analyze the Security Log events, and it generates easy-to-read reports, with bar graphs.
It comes with many precompiled reports, and I know there are file access reports.
I use it for failed logon events reports, personally.

Anyway, this would be an easy way of parsing through the log. You would run CyberSafe against the events, using its file access reports, and print them out. You can specify date/time parameters. It is a nice little tool.

So, if you have the Win2K Professional Resource Kit, try this out!

hope this helps

Well part of our problem is the log file runs itself out of space in less than a day. We can't have the log files over write themselves because we need the trail. We are getting A LOT of the 562 message and it is filling the log. That is actuallywhat I need to avoid.

Check out KB149401 on

http://support.microsoft.com/default.aspx?scid=kb;en-us;149401

The error message appears when no objects are specified to be audited. If I understood it right, you can get rid of it by narrowing the auditing field and specifiying directories to be audited (even if it is c:\)

I have already limited the auditing to the files only in one directory and by a limited number of users.

Try this: http://www.eventlogscan.com/

Try this: http://www.eventlogscan.com/

This question was closed by the author