Domain Security Policy

  • Thread starter Thread starter Steve
  • Start date Start date
S

Steve

I recently enabled "Audit Log On Events" on my domain.

I did it 'cause a recent termination and I wanted to see
if this person would even attempt to log in after
terminated and soon after I wanted to check for unusual
log on failures.

As I was checking the security log I notices that my user
account was popping up as log on and then log back off and
other accounts as well. I keep a very strick password
policy for my self, I change it every month and it is
always at least 12 alfanumeric caracters.

Could this be because Outlook was running on my machine at
the time?

How can I acurately audit log ons and offs on the network
by users? Is there a way to log user log ons to the
network in a clean manner?

I have two DCs, why some events show in one but not the
other?


Thanks for the help.
 
The best approach for a terminated employee would be to disable their domain
account, though auditing of logon events is a good practice.

Logon events are recorded on computers where it is enabled when ever a user
access the computer such as using a share via a type 3 network logon or a mapped
drive. It does differ from "account logon events" that primarily are recorded on
the computer that authenticates a user for logon to the domain or local machine.
Auditing of logon events on domain controllers will be more reliable on showing
when a user actually logged on and off of the domain. Logon events are recorded
on the domain controller that authenticates a user which means that the security
logs of the two domain controllers will be quite a bit different. You should be
able to track down explanations for seeing your user account in the security
logs. Keep in mind that best practice is to use an account that does not have
administrative powers when doing activity that does not require it and take
advantage of runas to do tasks that require admin rights. Also be very careful
where you logon with domain admin credentials. Use it only on computers you
trust 100 percent not to be compromised with a keyboard logger or such. --
Steve

http://www.microsoft.com/technet/security/prodtech/win2000/secwin2k/09detect.mspx
 
Back
Top