Folks, on one of the servers I manage, apparently someone had disabled some network components on a network interface and then re-enabled them 10 minutes later. Unfortunately this is a server that has a dozen admins (application dev types -- they're the customer and they are aware of the security ramifications). I checked the event logs for eventids 577/578 , but I wasn't able to find any events logged. Does anyone know if there is a way to audit changing of network components or a means by which I can log this activity. Thanks.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations John Tel on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Auditing Changes to Network Components
- Thread starter itsp1965
- Start date
Similar threads
- Locked
- Question
- Locked
- Question