Re: Account management events audit !!

From: Paul Bergson (pbergson_at_mnpower.com)
Date: 11/30/04 

Date: Tue, 30 Nov 2004 07:51:31 -0600

It can take a while for the gpo to replicate to users. Try again this
morning and see if it works now.

If not what is the server and client o/s? 

-- 
Paul Bergson  MCT, MCSE, MCSA, CNE, CNA, CCA
This posting is provided "AS IS" with no warranties, and confers no rights.
"fex" <anonymous@discussions.microsoft.com> wrote in message
news:9eb101c4d680$4cb8bd70$a401280a@phx.gbl...
> I applied the audit to default domain policy -I created
> users, deleted users moved rights and after all those
> changes i can't see any event id (624-625-630)
>
> Thanks any comment !!
>
> >-----Original Message-----
> >You probably have no users in the Default Domain
> Controllers OU (Only domain
> >controllers).  Put the auditing on an OU that contains
> users -or- put the
> >auditing on the default domain policy.  That should take
> care of the
> >problem.
> >
> >-- 
> >
> >Paul Bergson  MCT, MCSE, MCSA, CNE, CNA, CCA
> >
> >This posting is provided "AS IS" with no warranties, and
> confers no rights.
> >
> >
> >
> >"fex" <anonymous@discussions.microsoft.com> wrote in
> message
> >news:0dcc01c4d5a6$4888f880$a501280a@phx.gbl...
> >>
> >>  Hello,
> >>
> >>  I've been auditing multiple events (System Events ,
> >> Policy Changes , Logon Events , but specially all events
> >> referents to Account management events like (User
> Account
> >> create, User Account Deleted , etc ) However , I applied
> >> the auditing to the default group everyone on Defaul
> >> Domain Controller Policy , to check specially all
> changes
> >> made by users with domain admin rights. But at this
> moment
> >> they are changing users -passwords - deleting users
> and -
> >> I don't receive any event id; for instance (ID:624-627-
> 630)
> >> at the moment they applied any change on the DC.
> >>
> >> I would like to know what is my misconfiguration or I
> need
> >> more configuartion or the default group it is not
> applied
> >> right way ?
> >>
> >> I will thanks any comment !!!
> >
> >
> >.
> >

Relevant Pages

  • Re: Account management events audit !!
    ... I applied the audit to default domain policy -I created ... Controllers OU (Only domain ... Put the auditing on an OU that contains ... confers no rights. ...
    (microsoft.public.win2000.active_directory)
  • Re: BITS 2.0 Install Fails - Permission problem
    ... the proper users have these rights as well as the ones that Narayana listed. ... > perform system restore citing insufficient security privleges. ... >> It sounds as though a domain policy is set that trumps your local policy. ... >> don't think that even a domain admin can override it by editing the local ...
    (microsoft.public.windowsupdate)
  • Re: Running services under AD users
    ... the default domain policy processing. ... MVP - Directory Services ... This posting is provided "AS IS" with no warranties, and confers no rights. ... allow certain Windows Services to run as certain Active Directory ...
    (microsoft.public.windows.server.active_directory)
  • Re: Windows 2003 Power Cfg Permission
    ... Enabling the auditing of privilege use gave me the info. ... required in order to change Power Options. ... After re-adding the rights to ...
    (microsoft.public.windows.server.security)
  • Re: Error on password reset
    ... auditing to see what rights are being used during the execution. ... > Windows will attempt to disable this account. ... I'm not getting anything in the security event log, ...
    (microsoft.public.windows.server.active_directory)
Loading