Windows Forum

Ask something
Discussion Locked

Event auditing

0 helpful
1 reply

by gprinsloo

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have multiple server/windows os's to access from a NON admin user account for auditing/monitoring the security event logs for intrusion/lockouts.

1. The Remote registy service has to be disabled for security reasons.
2. The security staff monitoring may not have administrator rights, to protect evidenciary integrity.
3. The remote servers comprise of NT,2000 and 2003.

1. Results in the error log descriptions not being reflected.
2. The lack of admin rights prevent the use of /auxsource flag or remote dll file useage.
3. The NT4, 2000 and 2003 error description formats vary as does the machine from where the extract was run ie. XP,98 etc. which provides their own dll translation in the absence of remote resolution of error details.

Which of these 3 head aches are solveable and how.

Appreciate any input.

1 reply

by bfilmfan

The remote registry service has to be disabled to Everyone or just non-admins?

The security staff monitoring should be using a service account and a program to monitor events.

And unless you are monitoring all events, success and failure, you will not be able to record, see or even log some events, such as when an administrators logs into a domain controllers and deletes an OU. Since they have "permission" and you are logging only failures, well no one is going to know for sure who did it.

This is a known security risk in Microsoft products.

I recommend you take a look at the 2003 security guide for some guidance:

http://www.microsoft.com/technet/security/prodtech/windowsserver2003/W2003HG/SGCH00.mspx

Also note that with SP1 for Windows 2003, security delegation is again changing.

This discussion is closed to new replies.