Audit policy ?

  • Thread starter Thread starter Juan
  • Start date Start date
J

Juan

Hi everyone,

I would like to know which Audit entry in the security GPO I should check
regarding the change of Group Policies. I want to track who is changing the
GPOs in our DOMAIN especially the default domain GPO password policy

Thank you,

Juan
 
Hello, you have to set NTFS Audit permissions on your AD in order to check who is doing what. Unfortunatly, if you are not under AD, you may use the registry and set, in the same way as previously, some NTFS Audit entries on the registry by using regedit (Right buttons on each enty, then permissions, Advanced, Auditing). The problem is only to find which key is associated to a GPO policy. Laurent Vais WinSysBee Support Team nntp://news.free.fr/microsoft.public.win2000.security/<[email protected]>

Hi everyone,

I would like to know which Audit entry in the security GPO I should check
regarding the change of Group Policies. I want to track who is changing the
GPOs in our DOMAIN especially the default domain GPO password policy

Thank you,

Juan



[microsoft.public.win2000.security]
 
It is difficult to track all Group Policy changes though you can audit object access
to the GPO object, but for what you specifically are looking for enable auditing of
account management on your Domain Controller Security Policy and then look in the
security log for Event ID 643 in particular. See the link below for more
etails. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx
 
Thank you so much. This is what I needed.

Kind regards,

Juan
WinSysBee Support said:
Hello, you have to set NTFS Audit permissions on your AD in order to check
Click to expand...
who is doing what. Unfortunatly, if you are not under AD, you may use the
registry and set, in the same way as previously, some NTFS Audit entries on
the registry by using regedit (Right buttons on each enty, then permissions,
Advanced, Auditing). The problem is only to find which key is associated to
a GPO policy. Laurent Vais WinSysBee Support Team
nntp://news.free.fr/microsoft.public.win2000.security/ said:
Hi everyone,

I would like to know which Audit entry in the security GPO I should check
regarding the change of Group Policies. I want to track who is changing the
GPOs in our DOMAIN especially the default domain GPO password policy

Thank you,

Juan



[microsoft.public.win2000.security]
Click to expand...
 
Back
Top