Solved

Windows domain Security Audit

Posted on 2014-01-19
3
305 Views
Last Modified: 2014-02-03
MS has explained these 2 policies, but not clear:

**Directory service access. Audit this to see when someone accesses an Active Directory® directory service object that has its own system access control list (SACL).

**Logon events. Audit this to see when someone has logged on or off your computer (either while physically at your computer or by trying to log on over a network).

for the second one, I am not sure if they mean if someone has logged on or off your workstation or Domain controller. if it is from your your workstation, will the log show up in the DC? assuming that your workstation is member of the domain.

Thanks
0
Comment
Question by:jskfan
3 Comments
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 250 total points
ID: 39793139
It depends on how you logon as to where the events show up.   What is really not clear is Account Logon vs Audit Logon/Logoff.    I have had this link Favorited for years

http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447934.aspx

See if that helps and let us know what follow up questions you have.

Thanks

Mike
0
 
LVL 13

Accepted Solution

by:
Jaihunt earned 250 total points
ID: 39793803
0
 

Author Closing Comment

by:jskfan
ID: 39831171
Will check it later ......Thanks
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

A procedure for exporting installed hotfix details of remote computers using powershell
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

828 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question