Re: Auditing or preventing task manager from terminating a process

From: Slava M. Usov (stripit.slough_at_gmx.net)
Date: 07/13/04 

Date: Tue, 13 Jul 2004 22:04:46 +0200

"Ivan Brugiolo [MSFT]" <ivanbrug@online.microsoft.com> wrote in message
news:Ot6sXhPaEHA.712@TK2MSFTNGP11.phx.gbl...
> It should be the flag that is set on the OBJECT_HEADER when "audit object
> access" is enabed.

OK, I found it.

Hive: HKEY_LOCAL_MACHINE \SYSTEM
Key: \CurrentControlSet\Control\Lsa
Name: AuditBaseObjects
Type: REG_DWORD
Value: 1

With that setting on [reboot is required], and the object audit enabled, I
can finally see the audit of process objects.

It is documented in NT ResKit. It also says

[quote]

In addition to Files, Registry Keys, and Printers, Windows NT has a number
of objects that are not generally visible to or known by a typical user.
Application programmers or people writing I/O device drivers might have
learned about these objects in software development or device driver
development kits. Normal interactive users, however, have no direct ability
to affect these objects except as intended by Windows NT.

Generally speaking, these objects are used by Windows NT in a manner that
makes auditing their use not very interesting. In fact, doing so can
introduce so many audit entries into the security log that locating real
security problems becomes considerably more difficult.

[end quote]

I find the second paragraph quite true. It generates a lot of audit events.
What I do not understand is why all that stuff is generated. I see audit of
objects that do not have SACLs; that includes window stations and desktops,
and, less frequently, sections, mutants and events. Why are they audited?

S

Relevant Pages

  • Re: administrator sign on
    ... I dont' think Windows audits this by default. ... Event log in the Security log, in the Computer Management MMC. ... also audit success of, say, logon events, and probably also system events, ...
    (microsoft.public.security)
  • Re: Audit the administrator account?
    ... In a Windows NT domain, the security log of the PDC can be configured to ... "Audit these events" and turn on auditing for "User and Group Management"... ... Event Log for the PDC for event ID 628. ...
    (microsoft.public.win2000.security)
  • Re: colon in item id to DOS directory
    ... Windows is simply rejecting the file update. ... Deleting an item with a colon in the id of a DOS directory leaves the 0 ... Say AUDIT is a super-Q pointer to a DOS directory. ... :LIST AUDIT ...
    (comp.databases.pick)
  • RE: Tracking File Modifications by User?
    ... Based on the information you provided, it should be a windows 2000 issue. ... you can enable Audit log in Event log to do so. ... locate the file or folder you want to audit. ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • Re: Last to Modify
    ... The audit log question is moot though unless you have AD changes being logged ... Joe Richards Microsoft MVP Windows Server Directory Services ... >>To track changes within Active Directory you have to enable auditing. ... >>to track user activities and system-wide events in Active Directory. ...
    (microsoft.public.windows.server.active_directory)
Loading