-
November 23rd, 2004, 02:47 AM
#1
Member
How can you find out if someone is trying to change your policy?
Can someone please tell me how I can find out if anybody (without access) is trying to
change my policies.
This is in regards to Windows 2000 Operating system.
-
November 23rd, 2004, 03:48 AM
#2
enable auditing. audit policy changes - both failure and success. and pay attention to the date and times.
-
November 23rd, 2004, 03:50 AM
#3
Senior Member
Man, you have to be more specific. What exactly are you looking for? Without knowing exactly what you are talking about, I would say you could start logging privilage useage and object access. That is a start. Next time be a little more specific with your questions.
-
November 23rd, 2004, 03:59 AM
#4
Have you seen the film, "Scanners".
Well unless they are scanners it's impossible........................Or did you mean something else.
What happens if a big asteroid hits the Earth? Judging from realistic simulations involving a sledge hammer and a common laboratory frog, we can assume it will be pretty bad. - Dave Barry
-
November 23rd, 2004, 04:25 AM
#5
Member
Yeah I actually seen scanners, a long time ago though, but that's not what I meant.
anyway thanks secure_lockdown,
I eventually found Audit policy like you said and I just checked
successes and failures on Audit Policy Change.
Thanks for the tip sysmin770, I'll take it on board.
-
November 23rd, 2004, 04:36 AM
#6
good link to local policies. naturally, if you are domain, you will be tweaking domain cntrl policies.
http://www.microsoft.com/technet/Sec.../w2kadm10.mspx
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|