How can you find out if someone is trying to change your policy?

Can someone please tell me how I can find out if anybody (without access) is trying to
change my policies. :confused:

This is in regards to Windows 2000 Operating system.

enable auditing. audit policy changes - both failure and success. and pay attention to the date and times.

Man, you have to be more specific. What exactly are you looking for? Without knowing exactly what you are talking about, I would say you could start logging privilage useage and object access. That is a start. Next time be a little more specific with your questions.

Quote:

---

without access

---

Have you seen the film, "Scanners".

Well unless they are scanners it's impossible........................Or did you mean something else.

:D
Yeah I actually seen scanners, a long time ago though, but that's not what I meant.

anyway thanks secure_lockdown,

I eventually found Audit policy like you said and I just checked
successes and failures on Audit Policy Change.

Thanks for the tip sysmin770, I'll take it on board.

good link to local policies. naturally, if you are domain, you will be tweaking domain cntrl policies.
http://www.microsoft.com/technet/Sec.../w2kadm10.mspx