"Someone" has edited the group policy, audit logon/logoff?

[SmbNorway]

Hello!

"Someone" an intruder that by other things have deleted users files, edited the group policy on our servers was logged on yeasterday. We have now resett the password on several users but I would dearly wont to cach this person.

I have set up auditing of logon and logoff on the server in the group policies both success and fail but no event is logged in the security log. I have searched for this on the net but I cannot find a sulotion on it.

What am I missing?

smb

 

[GiaBetiu]

which group policy are you talking about?

But if you want to log all "logon" events then you should do this at the "DomainControllers" OU.

And set also a account lockuot policy. And maybe complex passwords.
But BEWARE! Account Policies should be applied at the DOMAIN GPO!! Gia Betiu
m.betiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[SmbNorway]

Hello!

The setting for logging the logoff and logon are set on the Domain GPO. But still no event are logged in the event viewer.

How would I else cach him I dont set up this??

smb

 

[GiaBetiu]

Then, check and see how the policies are applied. Have you a block inheritance there? (in Domain Controllers OU)
And, normally this should work without any problem.
I cannot imagine what mistake you did. Gia Betiu
m.betiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k

 

[SmbNorway]

Hello!

This is how I do it.

I open Actice Directory Users and Computers, I mark the domain, right click and choose properties, group policies, Default Domain Policy, Edit, ComputerConfiguration, Windows Settings, Security Settings, local policies, audit policies, audit account logon envents, I mark define these policy settings, mark success and failure, close the window, choose OK.

I dont now what block inheritance is, but maybe this is something the "hacker" have done.

smb

 

[GiaBetiu]

Maybe he set a length of zero for your event logs (also a setting from GPO).

But, try to see the differences between a default configuration and wat you have now. ALso try to apply the default one.
See my answer from the thread thread96-403270. Gia Betiu
m.betiu@chello.nl
Computer Eng. CNE 4, CNE 5, soon MCSE2k