Solved

Windows domain Security Audit

Posted on 2014-01-19
3
304 Views
Last Modified: 2014-02-03
MS has explained these 2 policies, but not clear:

**Directory service access. Audit this to see when someone accesses an Active Directory® directory service object that has its own system access control list (SACL).

**Logon events. Audit this to see when someone has logged on or off your computer (either while physically at your computer or by trying to log on over a network).

for the second one, I am not sure if they mean if someone has logged on or off your workstation or Domain controller. if it is from your your workstation, will the log show up in the DC? assuming that your workstation is member of the domain.

Thanks
0
Comment
Question by:jskfan
3 Comments
 
LVL 57

Assisted Solution

by:Mike Kline
Mike Kline earned 250 total points
ID: 39793139
It depends on how you logon as to where the events show up.   What is really not clear is Account Logon vs Audit Logon/Logoff.    I have had this link Favorited for years

http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447934.aspx

See if that helps and let us know what follow up questions you have.

Thanks

Mike
0
 
LVL 13

Accepted Solution

by:
Jaihunt earned 250 total points
ID: 39793803
0
 

Author Closing Comment

by:jskfan
ID: 39831171
Will check it later ......Thanks
0

Featured Post

Gigs: Get Your Project Delivered by an Expert

Select from freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
This article runs through the process of deploying a single EXE application selectively to a group of user.
To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…

776 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question