Audit policy ?

[Juan]

Hi everyone,

I would like to know which Audit entry in the security GPO I should check
regarding the change of Group Policies. I want to track who is changing the
GPOs in our DOMAIN especially the default domain GPO password policy

Thank you,

Juan

 

[WinSysBee Support]

Hello, you have to set NTFS Audit permissions on your AD in order to check who is doing what. Unfortunatly, if you are not under AD, you may use the registry and set, in the same way as previously, some NTFS Audit entries on the registry by using regedit (Right buttons on each enty, then permissions, Advanced, Auditing). The problem is only to find which key is associated to a GPO policy. Laurent Vais WinSysBee Support Team nntp://news.free.fr/microsoft.public.win2000.security/<[email protected]>

Hi everyone,

I would like to know which Audit entry in the security GPO I should check
regarding the change of Group Policies. I want to track who is changing the
GPOs in our DOMAIN especially the default domain GPO password policy

Thank you,

Juan



[microsoft.public.win2000.security]

 

[Steven L Umbach]

It is difficult to track all Group Policy changes though you can audit object access
to the GPO object, but for what you specifically are looking for enable auditing of
account management on your Domain Controller Security Policy and then look in the
security log for Event ID 643 in particular. See the link below for more
etails. --- Steve

http://www.microsoft.com/technet/security/guidance/secmod144.mspx

 

[Juan]

Thank you so much. This is what I needed.

Kind regards,

Juan

Hello, you have to set NTFS Audit permissions on your AD in order to check

who is doing what. Unfortunatly, if you are not under AD, you may use the
registry and set, in the same way as previously, some NTFS Audit entries on
the registry by using regedit (Right buttons on each enty, then permissions,
Advanced, Auditing). The problem is only to find which key is associated to
a GPO policy. Laurent Vais WinSysBee Support Team

Hi everyone,

I would like to know which Audit entry in the security GPO I should check
regarding the change of Group Policies. I want to track who is changing the
GPOs in our DOMAIN especially the default domain GPO password policy

Thank you,

Juan



[microsoft.public.win2000.security]