November 23rd, 2004, 01:47 AM
How can you find out if someone is trying to change your policy?
Can someone please tell me how I can find out if anybody (without access) is trying to
change my policies.
This is in regards to Windows 2000 Operating system.
November 23rd, 2004, 02:48 AM
enable auditing. audit policy changes - both failure and success. and pay attention to the date and times.
November 23rd, 2004, 02:50 AM
Man, you have to be more specific. What exactly are you looking for? Without knowing exactly what you are talking about, I would say you could start logging privilage useage and object access. That is a start. Next time be a little more specific with your questions.
November 23rd, 2004, 02:59 AM
Have you seen the film, "Scanners".
Well unless they are scanners it's impossible........................Or did you mean something else.
What happens if a big asteroid hits the Earth? Judging from realistic simulations involving a sledge hammer and a common laboratory frog, we can assume it will be pretty bad. - Dave Barry
November 23rd, 2004, 03:25 AM
Yeah I actually seen scanners, a long time ago though, but that's not what I meant.
anyway thanks secure_lockdown,
I eventually found Audit policy like you said and I just checked
successes and failures on Audit Policy Change.
Thanks for the tip sysmin770, I'll take it on board.
November 23rd, 2004, 03:36 AM
good link to local policies. naturally, if you are domain, you will be tweaking domain cntrl policies.