Re: Account management events audit !!

From: Paul Bergson (pbergson_at_mnpower.com)
Date: 12/01/04 

Date: Wed, 1 Dec 2004 07:40:53 -0600

Well if you had an 2003 server or xp client you could see the implied affect
on a user.

You could create a new ou and move one of your users to this ou and apply
the same auditing to it. Use this user to try and troubleshoot why you are
getting your failures.

Also make sure that you aren't blocking inheritance and on the gpo you are
setting specify no override. 

-- 
Paul Bergson  MCT, MCSE, MCSA, CNE, CNA, CCA
This posting is provided "AS IS" with no warranties, and confers no rights.
"fex" <anonymous@discussions.microsoft.com> wrote in message
news:003d01c4d731$adc25520$a401280a@phx.gbl...
> It doesn't work I'm using windows 2000 advanced server
> (Domain controller) windows professional (clients)
>
> Interesting !@!
>
> >-----Original Message-----
> >It can take a while for the gpo to replicate to users.
> Try again this
> >morning and see if it works now.
> >
> >If not what is the server and client o/s?
> >
> >-- 
> >
> >Paul Bergson  MCT, MCSE, MCSA, CNE, CNA, CCA
> >
> >This posting is provided "AS IS" with no warranties, and
> confers no rights.
> >
> >
> >
> >"fex" <anonymous@discussions.microsoft.com> wrote in
> message
> >news:9eb101c4d680$4cb8bd70$a401280a@phx.gbl...
> >> I applied the audit to default domain policy -I created
> >> users, deleted users moved rights and after all those
> >> changes i can't see any event id (624-625-630)
> >>
> >> Thanks any comment !!
> >>
> >> >-----Original Message-----
> >> >You probably have no users in the Default Domain
> >> Controllers OU (Only domain
> >> >controllers).  Put the auditing on an OU that contains
> >> users -or- put the
> >> >auditing on the default domain policy.  That should
> take
> >> care of the
> >> >problem.
> >> >
> >> >-- 
> >> >
> >> >Paul Bergson  MCT, MCSE, MCSA, CNE, CNA, CCA
> >> >
> >> >This posting is provided "AS IS" with no warranties,
> and
> >> confers no rights.
> >> >
> >> >
> >> >
> >> >"fex" <anonymous@discussions.microsoft.com> wrote in
> >> message
> >> >news:0dcc01c4d5a6$4888f880$a501280a@phx.gbl...
> >> >>
> >> >>  Hello,
> >> >>
> >> >>  I've been auditing multiple events (System Events ,
> >> >> Policy Changes , Logon Events , but specially all
> events
> >> >> referents to Account management events like (User
> >> Account
> >> >> create, User Account Deleted , etc ) However , I
> applied
> >> >> the auditing to the default group everyone on Defaul
> >> >> Domain Controller Policy , to check specially all
> >> changes
> >> >> made by users with domain admin rights. But at this
> >> moment
> >> >> they are changing users -passwords - deleting users
> >> and -
> >> >> I don't receive any event id; for instance (ID:624-
> 627-
> >> 630)
> >> >> at the moment they applied any change on the DC.
> >> >>
> >> >> I would like to know what is my misconfiguration or I
> >> need
> >> >> more configuartion or the default group it is not
> >> applied
> >> >> right way ?
> >> >>
> >> >> I will thanks any comment !!!
> >> >
> >> >
> >> >.
> >> >
> >
> >
> >.
> >

Relevant Pages

  • Re: Unable to start debugging
    ... >>if you are not an Administrator of the client or the server. ... >>must give full access rights to the folder where the executables are ... >>I think the problem with remote debugging is very similar to the Biztalk ...
    (microsoft.public.dotnet.framework.aspnet)
  • APM Connection Error With Clients
    ... running on a Windows 2003 server without IIS since when I ... connection account, push installation account Legacy ... administrative rights on the client computers and on the ... which gives the account rights to the ...
    (microsoft.public.sms.setup)
  • Re: Application Hang
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... only reply to Newsgroups ... indeed a problem with Excel files, Server 2008, and Symantec AV. ... a client and who's IP is issued from the router. ...
    (microsoft.public.windows.server.networking)
  • RE: Unable to start debugging
    ... This post is provided "AS-IS" with no warranties and confers no rights. ... >if you are not an Administrator of the client or the server. ... >Remote Access for ANONYMOUS LOGON. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Problems joining network with /connectcomputer
    ... > I have checked the Advanced Settings on both the server and this> client machine and they both have TCP/IP bound to File and Print> Sharing and Client for Microsoft network. ... On this machine that is unable to join the> network, you are correct that it will not join the network manually> either. ... >> This posting is provided "AS IS" with no warranties, and confers no rights. ...
    (microsoft.public.windows.server.sbs)