Security logs not updating

[Guest]

Greetings

I have an issue where there are no entries in the security log, and the
latest SecEvent.Evt file is nearly 1 1/2 years old! The other two event logs,
applications and system, are updating normally. I've looked at the reg keys
and they appear ok; any ideas?

WinXP Pro, SP2 and all the fixings,. McAfee v10
Thanks!

 

[Nepatsfan]

(e-mail address removed),

Greetings

I have an issue where there are no entries in the security
log, and the latest SecEvent.Evt file is nearly 1 1/2 years
old! The other two event logs, applications and system, are
updating normally. I've looked at the reg keys and they
appear ok; any ideas?

WinXP Pro, SP2 and all the fixings,. McAfee v10
Thanks!

Have you enabled auditing of account logon events in your Local
Security Policy?

Start -> Run -> secpol.msc or Start -> Control Panel ->
Administrative Tools -> Local Security Policy

Navigate to Security Settings\Local Policies\Audit Policy

Right click Account Logon Events in the right hand pane and
enable Success and Failure. That will cover the majority of
events. If you want you can also enable logging of additional
events. Take a look at this article for more information:

Enabling Auditing Policies
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prdd_sec_xutj.asp

Good luck

Nepatsfan

 

[Steven L Umbach]

Check the properties of the security log to make sure it is not set at "do
not overwrite events" (clear log manually). If it is change it to one of the
other options and you may want to increase the size of it quite a bit from
default. Also try clearing [clear all events] it in case there is some
corruption that it may clear up. --- Steve

 

[Guest]

Greetings

That solved the trick. Somehow the auditing for these events was disabled.
Don't know how or when but I've reenabled them and the security logs are now
again updating.Thanks! Didn't even theink of checking the audits...

Capwx

Have you enabled auditing of account logon events in your Local
Security Policy?

Start -> Run -> secpol.msc or Start -> Control Panel ->
Administrative Tools -> Local Security Policy

Navigate to Security Settings\Local Policies\Audit Policy

Right click Account Logon Events in the right hand pane and
enable Success and Failure. That will cover the majority of
events. If you want you can also enable logging of additional
events. Take a look at this article for more information:

Enabling Auditing Policies
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prdd_sec_xutj.asp

Good luck

Nepatsfan