0

I have been asked to find whether there is auditing enabled for one of our Windows Servers for accessing password hash files or other files used for authentication.

Does anyone know if there is a Logging or Auditing functionality in place for successful/unsuccessful access to password Hash Files and other files used in authentication on Windows Server 2008 R2?

Improve this question

1 Answer 1

Reset to default
1

Via a GPO you can activate the audit of a lot of things. For that, go to :

Computer Configuration / Policies / Windows Settings / Security Settings / Local Policies / Audit Policy

After, you'll be able to go to the properties of the interesting files and configure the audit. The results will appear in the logs of Windows.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .