Discussion Locked

How do I enable Auditing on a workstatio

0 helpful
10 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi,

I need to enable auditing logon/logoff events (I know about domain audits that's not what I'm looking for) but need to do so on an NT 4.0 Workstation remotely from my server or another workstation (I have Domain Admin rights).

Any suggestions?

10 replies

by padolle

The Microsoft Windows NT Resource Kit should give you the kind of tools you require to enable auditing remotely. This software usually comes with Microsoft Windows NT Administrators manuals that you can purchase from any bookstore.

by corky132

If the drive is NTFS, you should be able to get into it via the c$ share (administrative share), providing you know the workstation password. Highlight the folders/drives you wish to audit, right click, properties. Security/Auditing tab.

You canalso go into the user manager for that machine and turn on auditing thru there.

by dmiles

Start with installing Network Client
Reference NT Server CD-ROM-Located \Client\Srvtools directory
Administrator tools-you can run User Manager
Apply all security precautions appropriate for servers to your administrative computer
Enable Remote Access Auditing
Open Registry Editor by choosing Run from the Start menu and typing REGEDIT32
HKEY_LOCAL_MACHINE
drill down to SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters,highlight nad double click Enable Audit
Choose Audit in the Policies menu of the User Manager
Set audit Policies in User manager

by halleyc

1.Start User Manager for Domain
2.File > Select Domain
3.Type "\\YourWorkstationName" in the domain text box(i mean the workstation's computer name eg. if your workstation computer name is ws1234, type "\\ws1234")
4.policies > audit

by ruturaj

This is what worked I fell so stupid for putting up this question without trying but you told me I tried it works thank you

This discussion is closed to new replies.