Networks

Ask something
Discussion Locked

Security Logging

0 helpful
6 replies

by julied

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How can I enable security logging on a W2K client machine that is on a W2K network? I enbled auditing in the local group policy but my logs are still blank. It said that logging may be restricted by group policy on the server. Is this by default. Can't find a technet on it. How do I change this? And is it recommended? I can't find the steps in Technet and I am not too familiar with policies.

6 replies

by joseph moore

It depends on what you turned on for auditing. If, for example, you enabled Failure auditing of Logon & Logoff events, then your logs would NOT show anything if logons and logoffs on the Win2k machine were happing correctly (i.e. if no one tried to log in incorrectly).
IF you enabled file access auditing for Success and/or Failure, you then need to select folders/files on the system to BE audited. Only then would your Security log record anything.

So, please post what you turned on, and what type of auditing (Success and/or Failure) you are trying to enable.

by julied

I rebooted and now my logs are populated. If she wants to know when files are accessed and by whom how would I set this up? I don't see where to select files. I have enabled success and failure for audit account logon events, success and failure foraudit logon events, and success and failure for object access. What she wants is for no one else to be able to access anything on her machine at all. I am trying to get close to that.

by colin

You can enable the auditing in the properties of the files/folders that you want audited

This discussion is closed to new replies.