IT Employment

Ask something
Discussion Locked

Deny users from accessing the Event Logs

0 helpful
2 replies

by aviezov

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi All!
Few days ago I've realized that every user in my Windows 2000 domain can access the event logs (every one of them but the security logs) on all of my servers (including the Domain Controllers and Exchange Servers) with the "Computer Management" in his local system. Is there any possible way to secure those logs, deny access to authenticated domain users and allow only Domain Admins to browse them?

2 replies

by lordinfidel

In your default domain policy under:
User Configuration/Admin Templates/Windows Components/Microsoft Management Console/Restricted-permitted snap-ins.

Event viewer is in there.

by <--davor-->

Look in the Security Policy --> Event Log --> Settings for event log --> Restrict ...

Or

Open the Event Viewer and see the Logrootname (expl:C:\WINNT\System32\config\SecEvent.Evt) and change the security-options for that file ...

This discussion is closed to new replies.