Have you set up the system to do auditing? Start\run type secpol.msc then
under local policies\audit policy, check security setting is set to either
success\failure\both (depending on what you want to audit.) A dual server
logo next to the audit policy is indicative that the policy comes from the
domain level.
How To View and Manage Event Logs in Event Viewer in Windows XP WGID:358
ID: 308427
How To Audit User Access of Files, Folders, and Printers in Windows XP
WGID:374
ID: 310399
If you have set it up and it is failing it may be a corrupted log. Have you
tried to open it on another machine? Does the number of secuirty events
list anything other than 0?
Cheers, Les
This posting is provided "AS IS" with no warranties, and confers no rights.
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.
