Audit time change attempt by users and logging in event viewer

G

Guest

I have a Windows XP Pro desktop, I am trying to audit a system time change
failure attempt by a user. I have system event failures selected on my audit
policy and only have administrators allowed to change system time in user
rights assignments. When the user tries to change the system time from
anywhere, he is given a failure message but it will not log this event in the
security event viewer. I have even gone as far as going into regedt32 and
setting auditing on failure to access registry keys I believe have to do with
system time but still NOTHING LOGGED in security event viewer.
HKLM\microsoft\windows nt\current version\time zone
HKLM\system\current control set\control\timezone info
What am I missing? Thanks, Peter.
 
S

Steven L Umbach

You might try auditing for privilege use for failure to see if that
lps. --- Steve
 

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Event Viewer -- Failure Audit 627, Attempt to Change Password 2
Auditing system time changes 4
Failure Audits in the secruity log Event Viewer 3
Event Viewer Failure Audit messages under Security 3
"Failure Audit" Message in Event Viewer 3
Event 627 Failure of Change Password Attempt 8
Security Event Log Empty 1
Event Viewer "Failure Audit" 6

Top