Audit time change attempt by users and logging in event viewer

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have a Windows XP Pro desktop, I am trying to audit a system time change
failure attempt by a user. I have system event failures selected on my audit
policy and only have administrators allowed to change system time in user
rights assignments. When the user tries to change the system time from
anywhere, he is given a failure message but it will not log this event in the
security event viewer. I have even gone as far as going into regedt32 and
setting auditing on failure to access registry keys I believe have to do with
system time but still NOTHING LOGGED in security event viewer.
HKLM\microsoft\windows nt\current version\time zone
HKLM\system\current control set\control\timezone info
What am I missing? Thanks, Peter.
 
You might try auditing for privilege use for failure to see if that
lps. --- Steve
 
Back
Top