• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 352
  • Last Modified:

Windows domain Security Audit

MS has explained these 2 policies, but not clear:

**Directory service access. Audit this to see when someone accesses an Active Directory® directory service object that has its own system access control list (SACL).

**Logon events. Audit this to see when someone has logged on or off your computer (either while physically at your computer or by trying to log on over a network).

for the second one, I am not sure if they mean if someone has logged on or off your workstation or Domain controller. if it is from your your workstation, will the log show up in the DC? assuming that your workstation is member of the domain.

Thanks
0
jskfan
Asked:
jskfan
2 Solutions
 
Mike KlineCommented:
It depends on how you logon as to where the events show up.   What is really not clear is Account Logon vs Audit Logon/Logoff.    I have had this link Favorited for years

http://blogs.msdn.com/b/ericfitz/archive/2005/08/04/447934.aspx

See if that helps and let us know what follow up questions you have.

Thanks

Mike
0
 
jskfanAuthor Commented:
Will check it later ......Thanks
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now