The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
15 views

Win7 Desktops secpol and local security policy not showing auditing

I have a Server 2008 R2 and Windows 7 Desktops where I have a Server 2008 GPO to Audit Events on the server and desktops, however at the desktops locally auditing is greyed out and displaying ‘no ...
3
votes
3answers
3k views

Tracking file permissions changes on a Windows server

Some-thing or Some-one is changing file permissions occasionally on files on my Windows Server 2003 Domain Controller. I'd like to track these changes. Initially I thought one could do this with ...
0
votes
1answer
33 views

PAM tty auditing on CentOS 6.4

I am trying to implement pam tty auditing using http://jaredrobinson.com/blog/linux-tty-auditing/ but it is not working for me. Can some one tell me that any thing else apart from "session required ...
1
vote
1answer
74 views

Mistakenly configured advanced audit policies; return to basic?

I can't believe I did this... I set an advanced auditing policy in our GPO and it shut down all of our basic policies. From Technet: After you apply advanced audit policy settings by using Group ...
0
votes
2answers
135 views

Audit mailbox actions on Exchange

Is there a way to audit each action performed in an Exchange 2007 mailbox? In this particular case, a user, on many occasions, has complained that items from his contacts have dissapeared. I would ...
1
vote
0answers
28 views

Any audit trail of when Windows Server 2008 Automatic Updates settings are changed?

I have a Windows Server 2008 R2 machine that keeps on rebooting even though I tell it not to do so after automatic updates are installed. I am certain that no group policy is applied to this server to ...
1
vote
3answers
2k views

Turn on file auditing on network share in server 2008 r2

I have a server running 2008 R2 , is there a role / function on this that can be added / enabled that audits file access. e.g user1 deleted this folder, this file was edited by user2 etc. I have been ...
0
votes
2answers
1k views

Is there a way to list all of the email accounts on a cPanel server?

I manage a number of cPanel / WebHostManager servers. On one of these servers we need to do an audit of all the email accounts from all the cPanel accounts. This server has nearly 300 cPanel accounts, ...
0
votes
1answer
54 views

Exchange 2010 security audit

Our IT department has received reports from HR that managers are reading their subordinates email, and we've been tasked with identifying if there is a technical way to achieve this. I'm looking for ...
0
votes
0answers
87 views

Ms-exchange 2013 audit logs retrieving in csv format not working?

I need help regarding pulling specific information from exchange 2013. The information pertains to mail-exchange audit logs. The exchange in my environment is ms-exchange 2013. Steps performed so far ...
0
votes
1answer
39 views

How to enable auditing for a folder only (and not anything within that folder)

I am trying to track down a process responsible for resetting ACLs on a particular folder, and ONLY that folder, not any of the 10,000 folders and files it contains. I tried going to Properties > ...
0
votes
1answer
164 views

Creating a custom view for windows log based on a “Contains {text}” rule

I have a server running Windows Server 2008. I'm using Windows Server Auditing to check when and by which user a folder is modified to determine who is modifying it as the modifications are causing ...
4
votes
4answers
176 views

MSSQL Auditing Recomendations

As an aspiring DBA, I have recently been asssigned the task of implementing the tracking of all data changes in the database for a peice of software we are developing. After playing with microsoft's ...
0
votes
2answers
392 views

Sql Server 2008 R2 - Auditing and Change Data Capture - Who Changed what?

I am trying to establish auditing for a SQL Server database without using the trigger approach that is commonly used. I thought I could use CDC and Sql Server auditing. But both technologies do not ...
0
votes
1answer
65 views

Audit policy setting for cryptographic key operations

I'm getting a ton of 5061 and 5058 entries on my 2008 R2 servers although the audit policy should be suppressing them. Why? auditpol /get /category:* returns the following. System .... Other ...
2
votes
2answers
1k views

How to collect Security Event Logs for a single category via Powershell

I am trying to write a script which collects security log from all of our domain controllers hourly and stores them remotely; i can collect the security logs , but is there a way to collect the ...
1
vote
0answers
89 views

Windows 2008 R2 object access

On two domain controllers, auditing on a folder is turned on for (CREATE, WRITE, & DELETE), and well as the appropriate security policy. If a file is copied to this folder Windows will create the ...
0
votes
2answers
648 views

How can I audit ONLY logon / logoff's in Windows Domain

I am aware of multiple "auditing" questions around SF, however I feel as though this question is slightly different. The Goal: Audit only user logons and logoffs in my domain. The domain functional ...
2
votes
3answers
1k views

Can Windows logoff events be tracked?

I'm working on an application to track network user logon/logoff events in an Active Directory domain; the application will work by auditing security logs on domain controllers. Auditing logon events ...
0
votes
3answers
170 views

Audit Apache process creating files in /tmp

We have a Linux server at a large hosting provider that has approximately 75 Joomla! websites being hosted on it. We use maldet to scan daily for possible malware on all these sites. In the last week ...
2
votes
0answers
23 views

Audit usage of device special files

Windows natively supports auditing of access to file objects, which has been described already on SF, for example: how to audit which process accesses a file? The audit log then contains ...
1
vote
0answers
58 views

Ignoring auditing messages for particular PAM messages

I've got too many messages from PAM logging into audit.log, like this: type=USER_ACCT msg=audit(1378995943.792:867411): pid=4419 uid=0 auid=4294967295 ses=4294967295 ...
2
votes
3answers
6k views

Windows Server 2008R2 - Auditing changes to a service account

I want to setup auditing so I can see if any changes are being made to a service account (any changes) in AD which is used to run a backup application. What do I need to enable in Group Policy ...
1
vote
0answers
65 views

JAVA task reporting perodic file access issue but windows file auditing says it never tried?

Ok so you've got a JAVA task that reads a file on my local disk when it runs, it immediately closes the handle on the file right after it reads its, less than a second, nothing else on the entire ...
2
votes
4answers
2k views

File auditing software for Windows Server 2003

I am looking for a program or program suite that will allow the auditing of network shared resources (specifically storage space), and render reports (who created, deleted, moved, modified files, ...
1
vote
2answers
3k views

2008 DC GPO - “Advanced Audit Policy Configuration” missing?

I'm trying to enable Kerberos Authentication auditing in a GPO for the purpose of sending auth events to an AD-integrated web filter appliance, and the instructions have me enable auditing of the ...
2
votes
2answers
119 views

Some changes to audited AD user account not showing up in audit logs

In our Active Directory domain, we have some strange things happening to a certain user account: In the security rights for that user object, the "Include inheritable permissions from this object's ...
0
votes
1answer
2k views

What is the difference between an Audit Log and a regular Log (In the context of mod_security)?

I am using mod_security What is the difference between and audit log (audit trail) and a normal log? I read on wikipedia that an audit log is a log of user activity, if this is the case what would ...
1
vote
2answers
83 views

Looking for app/service to silently capture file changes in website (like SVN but automatic check-in) for auditing purposes [closed]

Here's the background to my question: A number of people deploy changes to our ASP.NET website ... designers deploy HTML and CSS changes, .NET developers deploy ASPX, DLL files, graphic designers ...
3
votes
1answer
253 views

How Do I Change the Active DIrectory Auditing Events Maximum?

We recently starting testing the ADAudit tool and turned on some new auditing features in AD. I have an LDAP Modify action in a custom program I've written that updates very large memberships for ...
1
vote
0answers
75 views

Trouble configuring file auditing on mac osx smb file shares to log hostnames of student laptops

I have a mac mini lion server that has a student username on it. All around the school the kids use laptops that connect to a share based on what classroom the laptop came from. It works like this. ...
0
votes
1answer
782 views

Extract sender activity from postfix logs for auditing user

We have a mail user on our postfix server that was using the company mail to send compromising information to the competence. I've been asked to make a report of the actions for that user in the last ...
1
vote
1answer
2k views

How to audit print jobs on windows server

I've set our 2003 Server to log spooler information events, which are then recorded in the system log (Event 10) in Event Viewer. This records the user who sent the print job, along with date/time, ...
0
votes
4answers
2k views

Tracking or auditing file copy

Everything that I know about programming tells me that this isn't a trivial task, but is there a way to track if something has been copied off a computer to an external drive? All I can find in ...
22
votes
6answers
713 views

How do I prove two files are the same legally?

We had someone steal some files before quitting and it has eventually come down to a lawsuit. I've now been provided with a cd of files and I have to "prove" that they are our files by matching them ...
1
vote
1answer
237 views

How can I set email notification on file creation on Windows 2003 R2?

Each of our jobs has a folder created by a batch file triggered by our accounting software at the time the job is entered. In that folder is a subfolder called "Sales Pictures". I would like to be ...
1
vote
0answers
154 views

Object Access event log - how to check default ACL on windows server 2003

MAster, I need to enable directory auditing on windows server 2003 to a specific directory. So first of all i set in the Defaul Domain Controller Policy / Security / Local / Audit / Object access ...
2
votes
1answer
896 views

Configuration Compliance auditing for many CentOS 5.x boxes

Current Situation I have a client with many (200x) CentOS 5.x servers deployed in various web, mail, database and file server roles, and these boxes have been variously administrated to a lessor or ...
4
votes
3answers
10k views

NTFS Permissions Auditing with PowerShell

I am working on a project where I need to be able to audit various users and user group permissions on a NTFS formatted Windows file server. I would like to use PowerShell and have it recursively ...
0
votes
1answer
325 views

Disable auditing of logon type 3 events

I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)? This ...
3
votes
1answer
271 views

Domain controller audit log

I am part of an internal software development group for an enterprise. We are being asked to build an Active Directory management web application. 1 of the primary reasons is the need to generate ...
0
votes
1answer
151 views

Audit Records queried from SQL Server 2008 (Database and Analysis Services)

I'm preparing a clinical data warehouse and I need to be able to audit the specific records that users query from either the relational database or the analysis services cubes. The key requirements ...
-1
votes
1answer
64 views

Log all the activity of screen session to a file

Is that possible to start a screen session on login of any users in Linux system and log each and every activity done by him in a file for later review or email that after his logout.. Basically, I ...
2
votes
2answers
76 views

Getting Physical Ram

What would be the preferred way of gathering how much RAM is in each of our 500+ windows (XP and 7) machines with the least amount of effort?
0
votes
1answer
232 views

Win Server 2003: missig 'Audit' tab in advanced security propperties

I am trying to set auditing on a specific file located in a share on a the server. The server is a DC (Win 2003). I enabled Auditing via the Domain Controller Security Policy, and I run GPUPDATE. When ...
3
votes
1answer
815 views

Exchange 2010 mailbox actions audit

Can somebody please link me to or provide me with instructions on how to enable auditing on all Exchange 2010 mailboxes so we can view when somebody accesses a mailbox that they are not the owner of. ...
2
votes
1answer
257 views

Server 2003 DNS Auditing

I used the instructions on the following link to set up DNS auditing on Server 2003: http://blogs.technet.com/b/yuridiogenes/archive/2008/03/06/auditing-a-dns-zone.aspx It works. When ever a forward ...
9
votes
3answers
2k views

Logging a “persons” activity in Linux

So I've read many of the posts related to this and have just come up more confused than before. There are recommendations for various tools including ttyrec, snoopy, acct, rootsh, sudosh, ttyrpld, ...
1
vote
1answer
246 views

Windows Search Service causing too many accessed files

I am trying to more closely audit my users access of files located on a file share. The files share is served by a server running windows server 2008 R2 and running the Windows Search Service. I am ...
1
vote
2answers
222 views

Email Archive Solution

I need recommendation for Email archive solution. We have setup hosting and email server on one of government enterprise where they need to store all incoming/outgoing emails for compliance and ...