Auditing Question

[bllester]

By default is a Win2003 server set to audit information sent by the clients. I need to know if it will audit information about startups, shutdowns, restarts, etc... by default?

 

[58sniper]

startup and shutdown events are logged in the system log, generally.

Pat Richard
Microsoft Exchange MVP
Contributing author Microsoft Exchange Server 2007: The Complete Reference

 

[Davetoo]

513 is a shutdown event...can't think of the startup off the top of my head...511 maybe?

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[bllester]

I noticed that the event viewer will tell me specific successes and failures. Is this an accurate way to measure this?

 

[Davetoo]

Well, I suppose as much as you can trust an event log I suppose yes, it's an accurate way to measure it.

(?)

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.