Hi All,
I really need some help with something - this is in relation to thread931-1285874 where our security logs are filling up with events, even thought we don't have auditing enabled on any files. This is really doing my head now and everywhere I turn on the net, I'm just hitting yet another wall. I've even seen even ID 566 on member servers, even thought I just read somewhere that you should only see them on Domain Controllers. So basically, what I'm after is a white paper which can tell me what events will go with what type of auditing (eg "audit logon events" can generate the following event ID's etc). I know this seems like a tall order, but I've already searched on the net and found nothing. I've even looked through and AD book and not found much in there either. Would really appreciate if somebody has a link with something like this
Thanks in advance
Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau
I really need some help with something - this is in relation to thread931-1285874 where our security logs are filling up with events, even thought we don't have auditing enabled on any files. This is really doing my head now and everywhere I turn on the net, I'm just hitting yet another wall. I've even seen even ID 566 on member servers, even thought I just read somewhere that you should only see them on Domain Controllers. So basically, what I'm after is a white paper which can tell me what events will go with what type of auditing (eg "audit logon events" can generate the following event ID's etc). I know this seems like a tall order, but I've already searched on the net and found nothing. I've even looked through and AD book and not found much in there either. Would really appreciate if somebody has a link with something like this
Thanks in advance
Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau