Am I being Hacked?

Success Audit:

An audited security access attempt that succeeds. For example, a user's successful attempt to log on the system will be logged as a Success Audit event.

Event Descriptions:

http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_evmonevents_5.htm

To view more details about an event:

http://www.microsoft.com/windows2000/en/server/help/default.asp?url=/windows2000/en/server/help/sag_evmonevents_5.htm

(REMOVE SPACES fromthe pasted URLs.)

Maxwell

These events was generated by an enabled audit.
If you don't recognize:
-computer: WHITESTAR
-domain: PROTECH
then can be an issue.
But I see that:
-ClientUserName
-ClientDomain
-ClientLogonID
are empty. Normaly here must be some information if the audit was enabled for all users.

I don't think you're being hacked. it seems it's just the system log on reading the SAM database when you log on. If you really want to know if you're being hacked you need to audit the C:\WINN
repair folder where the SAM file is. To do that followthis:
1. Enable Success and Failure in Local Policies-Audit Policy.
2. right click th repair folder which is inside the WINNT folder and go to properties-security tab the Dis-elec the "allow inheritable permissions" then delete all the users and groups who have access to this folder leavingo only the local administrator account (it means only the amadministrator can access this folder)
3. Next click advanced then the auditing tab and add the "Everyone" group. This way you will be auditing everyone who try to access the repair folder. Of course only the local administrator user can access this folder so all the other attempts in event will be recorded as a failure . Also this is a good aywayo check for attempts originated inside the network such as employees or user trying to access this folder to get the system password. This procedure can also be applied to sensitive documents or important data to keep an eye on who is accessing it or try to access it

To UserDeleted;
Your answer was very helpful however when you stated setting the success and failure setting in Audit policy did you mean set all of them? There are 9 audit policies, wouldn't object access be the only policy to set and if you enable all of the audit policies won't you bog down your security log?