Security in Advanced Server 2000

[Marvin Delossantos]

Does anyone know how to do the following:

- Log who logs on to a server
- Log who modifies local groups on a server
- Prevent people from clearing the Event Viewer log

 

[Salt_Peter]

Group Policy Objects are used to apply and enforce security. If the server
is a stand-alone server in a workgroup, modify it's local security from
administrative tools. You can specify what events to log and how the event
log is to be kept.

To prevent anyone from clearing an event log, don't give them membership to
any administrative local groups or otherwise grant them the right to clear
the log. It's also a good idea to restrict access to these log files by
using ntfs security. Keep in mind that if you deny domain users, you deny
admin as well. Don't use deny in ntfs unless you are aware of the
consequences.

If this server is on a domain, 2 GPO links exist by default, one domain wide
and one for the DC container. Both accessible from administrative tools and
Users and Computers tool.

To further help in delegating and enforcing security, learn how to use the
MS Management Console and it's add ins. Run > MMC > Add/Remove Add Inns and
later switch from Author mode to read only mode. That then is an MMC that
can be distributed with limited rights to subordinate users / techs.

Read up on W2K server whitepapers.