Windows 2000 logs

  • Thread starter Thread starter Pirillo
  • Start date Start date
P

Pirillo

I've three questions for the newsgroup:

1 - In wich windows 2000 log file can i find informations about login
attempts and related ip address ?
2 - Are there any problems if i rename the administrator account when the
server is already operative ?
3 - Which is the better method to find a sniffer or other similar softwares
?

Thanks to all
 
I can answer the first 2 and attempt the 3rd
1 - In wich windows 2000 log file can i find informations about login
attempts and related ip address ? Security log:
Click to expand...

300958 HOW TO: Monitor for Unauthorized User Access in Windows 2000
http://support.microsoft.com/?id=300958
2 - Are there any problems if i rename the administrator account when the
server is already operative ? For the most part - no. Unless you have
Click to expand...
services starting under the old account, you should not see any problem
with this, but I would test in your environment to make sure
3 - Which is the better method to find a sniffer or other similar
Click to expand...
softwares - Microsoft Netmon sends out a BONE every time it is fired off. I
do not know what other monitors would do.

Hope that helps

Steve Dodson [MSFT]
Directory Services
--------------------
From: "Pirillo" <[email protected]>
Subject: Windows 2000 logs
Date: Tue, 7 Oct 2003 09:49:41 +0200
Lines: 12
X-Priority: 3
X-MSMail-Priority: Normal
X-Newsreader: Microsoft Outlook Express 6.00.2800.1158
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165
Message-ID: <[email protected]>
Newsgroups: microsoft.public.win2000.security
NNTP-Posting-Host: 62.123.109.1
Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
Xref: cpmsftngxa06.phx.gbl microsoft.public.win2000.security:12320
X-Tomcat-NG: microsoft.public.win2000.security

I've three questions for the newsgroup:

1 - In wich windows 2000 log file can i find informations about login
attempts and related ip address ?
2 - Are there any problems if i rename the administrator account when the
server is already operative ?
3 - Which is the better method to find a sniffer or other similar softwares
?

Thanks to all
Click to expand...


--

This posting is provided "AS IS" with no warranties, and confers no rights.
Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
 
Back
Top