GPO Policy Auditing Solution

From: Dave Leonardi (cyberfrost100_at_yahoo.com)
Date: 03/15/04 

Date: Mon, 15 Mar 2004 10:08:22 -0500

Good Morning,

        I was wondering if someone could assist me with a group policy
auditing scenario. I would like to apply successful/failure auditing only on
a group of computers in a computer lab, not the whole domain. What is
happening is certain individuals are logging on to the classroom computers
when they have no business being there. I would like to find out who is
attempting logon without authorization.
        I created an OU called CCSLAB, which contains all the lab computers,
and has an attached group policy underneath it named CCSLAB computer policy
(no settings created for now). I also have noted that under my default
domain controller policy, all auditing features are set to no auditing by
default. I set the audit logon events to success/failure on the domain
controller default policy, but it's grabbing everyone. Needless to say that
went away quickly. I would appreciate it if someone could propose a solution
to monitor user logon just for the CCSLAB OU. Thanks for your time it is
greatly appreciated.

Regards,

David Leonardi

Relevant Pages

  • Re: Reinstall everytime assigned applications through GPO on start
    ... Software installation extension has been called for background policy refresh ... Stations - R&D Software (EMEA computers). ... Stations - R&D Software (EMEA computers) is set for installation because it ... The assignment of application Remote Administrator v2.1 from policy Software ...
    (microsoft.public.windows.group_policy)
  • Re: better way to limit users/group to logon to specific workstati
    ... You can still do it in policy, ... logon locally setting, and apply it to all computers except the ones you ... Workstations" attribute - applying to the user accounts ...
    (microsoft.public.windows.group_policy)
  • Re: EventID 1054 from Userenv for startup script
    ... Did you configure the mentioned policy for the XP computers? ... startup script currently does not have Authenticated Users in its ACL. ... It obviously gets group policy ...
    (microsoft.public.windows.group_policy)
  • Re: Remote Desktop thru VPN and Network Security
    ... You can use Remote Access Policies to configure exactly what users can ... access via their VPN connection. ... If you create a policy you can then edit ... infection if users are copying files back and forth between computers. ...
    (microsoft.public.security)
  • Re: Remote Desktop thru VPN and Network Security
    ... You can use Remote Access Policies to configure exactly what users can ... access via their VPN connection. ... If you create a policy you can then edit ... infection if users are copying files back and forth between computers. ...
    (microsoft.public.windowsxp.security_admin)