The auditing tag has no wiki summary.
-7
votes
0answers
29 views
Translate guid of a property in active directory [closed]
below are the guid's of the properites from event id 4662 ,would like to translate, any information would be helpful.
Properties: Write Property
{771727b1-31b8-4cdf-ae62-4fe39fadf89e}
...
-1
votes
0answers
13 views
Auditing software development processes [closed]
I work for a UK based company that develops software for highly technical machinary. There are several different models of each machine. We tend to customise quite a few of the machines we build to ...
1
vote
2answers
180 views
2008 DC GPO - “Advanced Audit Policy Configuration” missing?
I'm trying to enable Kerberos Authentication auditing in a GPO for the purpose of sending auth events to an AD-integrated web filter appliance, and the instructions have me enable auditing of the ...
2
votes
2answers
31 views
Some changes to audited AD user account not showing up in audit logs
In our Active Directory domain, we have some strange things happening to a certain user account:
In the security rights for that user object, the "Include inheritable permissions from this object's ...
3
votes
1answer
102 views
How Do I Change the Active DIrectory Auditing Events Maximum?
We recently starting testing the ADAudit tool and turned on some new auditing features in AD.
I have an LDAP Modify action in a custom program I've written that updates very large memberships for ...
1
vote
0answers
46 views
Trouble configuring file auditing on mac osx smb file shares to log hostnames of student laptops
I have a mac mini lion server that has a student username on it. All around the school the kids use laptops that connect to a share based on what classroom the laptop came from. It works like this.
...
1
vote
2answers
70 views
Looking for app/service to silently capture file changes in website (like SVN but automatic check-in) for auditing purposes [closed]
Here's the background to my question:
A number of people deploy changes to our ASP.NET website ... designers deploy HTML and CSS changes, .NET developers deploy ASPX, DLL files, graphic designers ...
0
votes
1answer
152 views
How can I audit ONLY logon / logoff's in Windows Domain
I am aware of multiple "auditing" questions around SF, however I feel as though this question is slightly different.
The Goal: Audit only user logons and logoffs in my domain. The domain functional ...
0
votes
1answer
69 views
Audit mailbox actions on Exchange
Is there a way to audit each action performed in an Exchange 2007 mailbox? In this particular case, a user, on many occasions, has complained that items from his contacts have dissapeared. I would ...
0
votes
0answers
99 views
Windows Server 2008 Security Auditing Disabled
I have a Windows Server 2008r2 that is hosted by a 3rd party company (fairly common set up where the hosting company provides the hardware/software).
A few days ago, I noticed all of the Security ...
1
vote
1answer
725 views
How to audit print jobs on windows server
I've set our 2003 Server to log spooler information events, which are then recorded in the system log (Event 10) in Event Viewer. This records the user who sent the print job, along with date/time, ...
1
vote
1answer
154 views
How can I set email notification on file creation on Windows 2003 R2?
Each of our jobs has a folder created by a batch file triggered by our accounting software at the time the job is entered. In that folder is a subfolder called "Sales Pictures". I would like to be ...
1
vote
1answer
1k views
Windows Server 2008R2 - Auditing changes to a service account
I want to setup auditing so I can see if any changes are being made to a service account (any changes) in AD which is used to run a backup application.
What do I need to enable in Group Policy ...
0
votes
1answer
323 views
Is there a way to list all of the email accounts on a cPanel server?
I manage a number of cPanel / WebHostManager servers. On one of these servers we need to do an audit of all the email accounts from all the cPanel accounts. This server has nearly 300 cPanel accounts, ...
0
votes
1answer
124 views
Creating a custom view for windows log based on a “Contains {text}” rule
I have a server running Windows Server 2008.
I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
0
votes
1answer
193 views
Sql Server 2008 R2 - Auditing and Change Data Capture - Who Changed what?
I am trying to establish auditing for a SQL Server database without using the trigger approach that is commonly used.
I thought I could use CDC and Sql Server auditing. But both technologies do not ...
1
vote
0answers
123 views
Object Access event log - how to check default ACL on windows server 2003
MAster,
I need to enable directory auditing on windows server 2003 to a specific directory.
So first of all i set in the Defaul Domain Controller Policy / Security / Local / Audit / Object access ...
2
votes
1answer
539 views
Configuration Compliance auditing for many CentOS 5.x boxes
Current Situation
I have a client with many (200x) CentOS 5.x servers deployed in various web, mail, database and file server roles, and these boxes have been variously administrated to a lessor or ...
1
vote
2answers
272 views
Turn on file auditing on network share in server 2008 r2
I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
0
votes
1answer
210 views
Extract sender activity from postfix logs for auditing user
We have a mail user on our postfix server that was using the company mail to send compromising information to the competence.
I've been asked to make a report of the actions for that user in the last ...
0
votes
1answer
249 views
Disable auditing of logon type 3 events
I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)?
This ...
4
votes
3answers
8k views
NTFS Permissions Auditing with PowerShell
I am working on a project where I need to be able to audit various users and user group permissions on a NTFS formatted Windows file server. I would like to use PowerShell and have it recursively ...
3
votes
1answer
164 views
Domain controller audit log
I am part of an internal software development group for an enterprise. We are being asked to build an Active Directory management web application. 1 of the primary reasons is the need to generate ...
-1
votes
1answer
49 views
Log all the activity of screen session to a file
Is that possible to start a screen session on login of any users in Linux system and log each and every activity done by him in a file for later review or email that after his logout..
Basically, I ...
0
votes
1answer
103 views
Audit Records queried from SQL Server 2008 (Database and Analysis Services)
I'm preparing a clinical data warehouse and I need to be able to audit the specific records that users query from either the relational database or the analysis services cubes. The key requirements ...
2
votes
2answers
76 views
Getting Physical Ram
What would be the preferred way of gathering how much RAM is in each of our 500+ windows (XP and 7) machines with the least amount of effort?
0
votes
0answers
346 views
Capturing Logons/Logoffs with BgInfo & GPO
I've set up a fairly straightforward run of BgInfo with two different configuration files (bgi files). One to record Logon event and one to record Logoff/Shutdown event.
I created an extra field, ...
0
votes
1answer
137 views
Win Server 2003: missig 'Audit' tab in advanced security propperties
I am trying to set auditing on a specific file located in a share on a the server.
The server is a DC (Win 2003).
I enabled Auditing via the Domain Controller Security Policy, and I run GPUPDATE.
When ...
3
votes
1answer
557 views
Exchange 2010 mailbox actions audit
Can somebody please link me to or provide me with instructions on how to enable auditing on all Exchange 2010 mailboxes so we can view when somebody accesses a mailbox that they are not the owner of.
...
6
votes
3answers
1k views
Logging a “persons” activity in Linux
So I've read many of the posts related to this and have just come up more confused than before. There are recommendations for various tools including ttyrec, snoopy, acct, rootsh, sudosh, ttyrpld, ...
1
vote
1answer
209 views
Windows Search Service causing too many accessed files
I am trying to more closely audit my users access of files located on a file share. The files share is served by a server running windows server 2008 R2 and running the Windows Search Service. I am ...
1
vote
2answers
191 views
Email Archive Solution
I need recommendation for Email archive solution. We have setup hosting and email server on one of government enterprise where they need to store all incoming/outgoing emails for compliance and ...
0
votes
4answers
1k views
Tracking or auditing file copy
Everything that I know about programming tells me that this isn't a trivial task, but is there a way to track if something has been copied off a computer to an external drive? All I can find in ...
9
votes
7answers
2k views
Hacking prevention, forensics, auditing and counter measures
Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security:
My server's been hacked EMERGENCY.
Finding how a hacked server was hacked
File ...
0
votes
4answers
122 views
Remote reboot of windows to knoppix
I am attempting to develop an Auditing application.
This audit application will be employed on windows networks.
The Audit will need to discover Hardware and software details of all machines ...
0
votes
1answer
186 views
How can I tell who created a Hyper-V guest after the fact?
I have a situation where I have Hyper-V Servers being created on a customer's system.
Is there any way I can find out who created them?
I realise anybody could get hold of the Administrator account ...
1
vote
1answer
863 views
Setting up auditing on folder deletion
We just had an incident where some random files were deleted on the server.
I've setup auditing now, but since I'm just a developer I want to make sure I got it right:
In folder security tab, ...
2
votes
1answer
191 views
Server 2003 DNS Auditing
I used the instructions on the following link to set up DNS auditing on Server 2003:
http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx
It works. When ever a forward ...
2
votes
2answers
2k views
Tracking file permissions changes on a Windows server
Some-thing or Some-one is changing file permissions occasionally on files on my Windows Server 2003 Domain Controller.
I'd like to track these changes. Initially I thought one could do this with ...
1
vote
1answer
9k views
How can I tell who deleted a folder from a public share?
Like a lot of offices we have a few public shares for different teams to save their data. Today I helped someone restore some folders from a shadow copy that had been deleted sometime last week. While ...
0
votes
1answer
1k views
What is the difference between an Audit Log and a regular Log (In the context of mod_security)?
I am using mod_security
What is the difference between and audit log (audit trail) and a normal log?
I read on wikipedia that an audit log is a log of user activity, if this is the case what would ...
2
votes
2answers
670 views
Can Windows logoff events be tracked?
I'm working on an application to track network user logon/logoff events in an Active Directory domain; the application will work by auditing security logs on domain controllers.
Auditing logon events ...
2
votes
4answers
1k views
File auditing software for Windows Server 2003
I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
20
votes
6answers
661 views
How do I prove two files are the same legally?
We had someone steal some files before quitting and it has eventually come down to a lawsuit. I've now been provided with a cd of files and I have to "prove" that they are our files by matching them ...
4
votes
3answers
159 views
MSSQL Auditing Recomendations
As an aspiring DBA, I have recently been asssigned the task of implementing the tracking of all data changes in the database for a peice of software we are developing. After playing with microsoft's ...
