Windows Forum

Ask something
Discussion Locked

Windows XP security event 560

0 helpful
4 replies

by dharwell

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am currently attempting to update several system to meet government NISPOM specifications. These are clone and rack mount PC's running Windows XP Pro. There are specific files that are restricted from acess, and these files, when changes are attempted, should generated a 560 security event in the event viewer. The issue is that none of the systems involved will record this event! Microsoft unfortunately has been no help to this point.

4 replies

by allthegoodnamesweregone

actually, i think the auditing has to be enabled in the policy and on the objects as well. from security settings on C drive, go to advanced and the auditing tab. add the Users group, select the level of auditing you want, and set the replace auditing entriest on all child objects with entries shown here that apply to child objects checkbox.

by sgt_shultz

what events *are* you getting?
562 567?
i wonder exactly what the spec is that you are trying to meet. i mean, what is the exact wording

This discussion is closed to new replies.