Event viewer/security log

[Thomas Wendell]

Need help again...

I understood that XPhome does not have any audit on success/failure in
events
But now my security log in event viewer just gets filled up with events 515
and 517 (at least, I just emptied it)

How to stop it??


(On my XPpro the security log has been empty since installing some 2 years
ago(and reinstalling 2months ago)



--
=================================
Most learned on these newsgroups
Tumppi, Helsinki, FINLAND
(translations from/to fi not always accurate
=================================

 

[Guest]

Click on the url for the event,this opens help/support in xp,usually with a
fix to the problem..

 

[Thomas Wendell]

Events are now 515, 516, 526, 540 576, 640 (at least). Most are success


But when i click on the link
http://go.microsoft.com/fwlink/events.asp.


and send the info, I get

Pahoittelumme
Tästä aiheesta ei ole nyt lisätietoja virhelokin ja tapahtumalokin
sanomissa eikä Knowledge Base -tietokannoissa. Voit selvittää tukialueen
linkkien avulla, onko muualla käytettävissä lisätietoja.


We're sorry
There's no additional information on error- and eventlog reports or
Knowledge base databases. You can explore the support area links to see if
there's additional info somewhere
(read sig)



--
=================================
Most learned on these newsgroups
Tumppi, Helsinki, FINLAND
(translations from/to fi not always accurate
=================================

 

[Sharon F]

Need help again...

I understood that XPhome does not have any audit on success/failure in
events
But now my security log in event viewer just gets filled up with events 515
and 517 (at least, I just emptied it)

How to stop it??


(On my XPpro the security log has been empty since installing some 2 years
ago(and reinstalling 2months ago)

Don't know the answer to your question but thought I would share a
reference site with you that might be helpful:
http://www.eventid.net/

 

[Nepatsfan]

Need help again...

I understood that XPhome does not have any audit on
success/failure in events
But now my security log in event viewer just gets filled up
with events 515 and 517 (at least, I just emptied it)

How to stop it??


(On my XPpro the security log has been empty since
installing some 2 years ago(and reinstalling 2months ago)



--
=================================
Most learned on these newsgroups
Tumppi, Helsinki, FINLAND
(translations from/to fi not always accurate
=================================

Thomas,

XP Home Edition records a number of different events to the
Security log by default.
I believe you'll find entries for the following categories:
Account Logon, Logon/Logoff, System Events, Policy Change and
Privilege Use. I've read that you can use a tool from the
Windows 2000 Server Resource Kit, auditpol.exe, to disable this
feature. I've never tried the procedure so I cannot comment on
how it works. Personally, I can't think of a reason why I'd
want to disable Security logging. I consider it a useful tool.

As you've noted, auditing of these events has to be enabled on
a XP Professional system through the Local Security Policy.
You're also able to audit more events in XP Pro. The Object
Access category is one that is only available in XP Pro.

If you're looking for more info on a particular Event ID, you
might want to visit this web site:

Windows Security Log Encyclopedia
http://www.ultimatewindowssecurity.com/encyclopedia.html

Microsoft provides some information in Appendix E of the XP
Resource Kit. Click on each section of the appendix to view a
description of many of the events ID's.

Appendix E Security Event Messages:
http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prnf_msg_efgd.asp

If none of the above information answers your question, post
back with more details on exactly what you're trying to have
clarified.

Good luck

Nepatsfan

 

[Thomas Wendell]

Not really a problem, just wondered why the sec. log on my XPhome gets a lot
of events, while the one on my XPpro is always empty..

I'll just let it be..


--
=================================
Most learned on these newsgroups
Tumppi, Helsinki, FINLAND
(translations from/to FI not always accurate
=================================