Re: Win2k Security Log Scripting Context Issues

Tech-Archive recommends: Speed Up your PC by fixing your registry

Everyone... Success!

I hope that this article will at least show up on some searches...
Finally after many days of searching I was steered in the right
direction... the issue with this is the WMI context being used
locally... when pushed over the network the impersonate levels were
expected... however locally, this syntax change is needed:

Set objWMIService = GetObject("winmgmts:" _
& "{impersonationLevel=impersonate,(Security)}!\\" & strComputer &
"\root\cimv2")

put in ,(Security) and it's done...

I'm satisfied! Thanks!

-Sonny

.

Relevant Pages

  • Router log question
    ... I have tried searching back in this group from Dec 2003 for the answer to my ... question with no success. ... My router is set up to use a WEP ... I might have to re-evaluate the level of security I am applying ...
    (comp.security.firewalls)
  • RE: Cant get rid of success audits in security portion of event viewer!
    ... I understand that you want to disable the success Security Auditing on the ... Business Server Auditing Policy. ...
    (microsoft.public.windows.server.sbs)
  • RE: Frequent logon success audits in event viewer
    ... In SBS 2003, the full security audit is enabled by default so that you are ... If you do want to stop these events, you can turn off Success logon ...
    (microsoft.public.windows.server.sbs)
  • RE: Large amounts of event ids 538 and 540
    ... In SBS 2003, the full security audit is enabled by default so that you are ... double-click Audit logon events and clear the Success ... SBS 2003 creates a GPO on the DC container named Small Business Server ...
    (microsoft.public.windows.server.sbs)
  • Re: 4 users logging in 39,250 times a day?!
    ... Success auditing is good from a security perspective. ... If you have 300,000 logon failures and they are continuing you basically don't have a lot to worry about, someone is cracking your server by brute force and your password complexity policy is stopping them. ... IF however you have 300,000 logon failures and they suddenly stop, just after a success event for the same process/IP, you have a MAJOR PROBLEM, your server is toast, owned by someone else and you have the proof of it in your logs. ... SBS remote support services. ...
    (microsoft.public.windows.server.sbs)