Local Administrators Group

[Newsgroup]

How can I find out when the local Administrators group was last modified or
the last several times it was modified?

Thanks

 

[Lanwench [MVP - Exchange]]

How can I find out when the local Administrators group was last modified
or the last several times it was modified?

Thanks

You can only see this information if you have previously enabled auditing
that will track this - you can't do it after the fact.

 

[Steven L Umbach]

You will need to enable auditing of account management in Local Security
Policy which is only available in XP Pro then you can track changes from now
on. --- Steve

 

[Newsgroup]

What event should I look for?

Thanks

You will need to enable auditing of account management in Local Security
Policy which is only available in XP Pro then you can track changes from
now on. --- Steve

 

[Steven L Umbach]

Probably Event IDs 636 and 637 as shown in the description of account
management events in the link below. Below is an example I just generated
on my computer so you can see one. The caller user name is the user that
added the user to the administrators group. --- Steve

http://www.microsoft.com/resources/...Windows/XP/all/reskit/en-us/prnf_msg_zzss.asp

Event Type: Success Audit
Event Source: Security
Event Category: Account Management
Event ID: 636
Date: 1/12/2006
Time: 10:28:09 PM
User: STEVE-XP\Steve
Computer: STEVE-XP
Description:
Security Enabled Local Group Member Added: <<<<<<<<<<<<
Member Name: -
Member ID: STEVE-XP\Darth <<<<<<<<<<
Target Account Name: Administrators <<<<<<<<<<<<<
Target Domain: Builtin
Target Account ID: BUILTIN\Administrators
Caller User Name: Steve <<<<<<<<<<<<<
Caller Domain: STEVE-XP
Caller Logon ID: (0x0,0x2F42A2)
Privileges: -


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.