#65069 - 2002-04-30 10:54 PM
Turn on auditing
|
New Mexico Mark
Hey THIS is FUN
Registered: 2002-01-03
Posts: 223
Loc: Columbia, SC
|
This is more of a network question, but since we have so many network / OS gurus who hang out in this forum, I thought this might be a great place to start.
We have been tasked to turn on auditing for logon/logoff for all our local user systems. We manage a network of about 600 workstations, all NT or Windows 2K Pro. Active directory has not been implemented yet. This change might also involve changing the log size if the size is below a minimum (to be determined).
Any thoughts on the best way to approach this? Registry hack? Instantiate a system object and use properties/methods there?
Ideally (going above and beyond customer requirements), I would like to offer a script solution that would do the following from the logon script (or a script called from the logon script):
1. Check during logon to see if auditing for logon/logoff is turned on.
2. Turn on auditing for policy changes.
3. For 1. and 2., if these were off, flag this in the user's logon script log. (In case a user keeps turning it off again.)
4. If the security event log has not been backed up in X days, back it up, clear it, and put an entry into the registry with today's date.
Thanks!
New Mexico Mark
P.S. Did I mention that the customer wants this done last week? (Big surprise there, huh?) That's why I'm scrambling to get advise.
[ 30 April 2002, 22:57: Message edited by: New Mexico Mark ]
|
|
Top
|
|
|
|
|
#65070 - 2002-05-01 12:09 AM
Re: Turn on auditing
|
Radimus
Moderator
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
Auditing for logon typically needs to be set on the DCs
|
|
Top
|
|
|
|
|
#65071 - 2002-05-01 12:14 AM
Re: Turn on auditing
|
BrianTX
Korg Regular
Registered: 2002-04-01
Posts: 895
|
In Windows 2000, to get the registry key for logging:
$value = READVALUE ("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SeCEdit","LastWinLogonConfig")
This is a "REG_DWORD" value.
If logging is disabled for success and failure the value is:
704670333 (DECIMAL), 2a006a7d (HEX)
If logging is enabled for both, you get:
2a0068df (HEX), 704669919 (DECIMAL)
For logging enabled for success only:
2a006ca7 (HEX), 704670887 (DECIMAL)
For logging enabled for failure only:
2a006ce1 (HEX), 704670945 (DECIMAL)
At least this is how it appears to work on my Win2k System. I assume it's totally different for NT. That's not all... You have to be able to set the security for auditing functions. By default, no user is given auditing rights. This is the tough part because it's encrypted in the registry. You have to give logged on users auditing access to the winlogon registry key for auditing to work. How to make this work is a big guess. Someone else might know of a tool that allows you to add auditing security to someone's user ID. I would assume you have to have administrator access on the PC to change the security settings....
Another thing.. auditing settings on Windows 2000 can be overriden at the domain level, so the best way to do this may NOT be logon scripts.. just a thought.
(I don't have NT, but this is information I found looking at Windows 2000.)
Brian
|
|
Top
|
|
|
|
|
#65076 - 2002-05-02 08:17 PM
Re: Turn on auditing
|
Radimus
Moderator
Registered: 2000-01-06
Posts: 5187
Loc: Tampa, FL
|
|
|
Top
|
|
|
|
Moderator: Glenn Barnas, NTDOC, Arend_, Jochen, Radimus, Allen, ShaneEP, Ruud van Velsen, Mart
|
0 registered
and 2220 anonymous users online.
|
|
|
