Administrator activities log

[Fawazeto]

There is a way where i can activate a log of the
administrator activities on windows 2000 server? like
deleting files/folders, changing passwords, login/logoff,
etc..

 

[Danny Sanders]

Not that I'm aware of. If there were, the admin could delete or empty it if
they wanted to.


hth
DDS W 2k MVP MCSE

 

[Steven L Umbach]

You can enable auditing on the computer in Local Security Policy or in
Domain Controller Security policy for domain controllers.I suggest you audit
at least logon events and account management to log all user logons/logoffs
and when user accounts are changed. You can also audit object access and
then enable auditing on folders but I suggest you do that very sparingly to
only critical folders and only for deletion permissions for the users you
want to monitor. Just enabling auditing of object access alone will generate
lots of events in the security log. Be sure to increase the size of the
security log substantially. The links below provide more detailed info. ---
Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;300549
http://support.microsoft.com/default.aspx?scid=kb;en-us;301640
http://www.microsoft.com/technet/security/guidance/secmod144.mspx