Reviewing Audit logs

[neilybealy]

hi all

is there an easy way to review the audit logs on windows server 2003?

thanks

neil

 

[Teknoratti]

Is this a trick question? Are you looking for an EASIER way to review audit logs, other than through the event viewer?

 

[neilybealy]

sorry no it's not a trick question!

yes looking for another way of reviewing other than using event viewer

 

[jollyreaper]

Wonder of wonders, I was logging on to post this exact same question!

I see that we can enable logging but it won't tell us who did the bad deed. It'll tell us that five people modified a file but not that Bob from Accounting deleted the important worksheet from the spreadsheet. It's sort of like the same situation with the bathroom -- you know it's the men's room so it had to be a guy but you don't know which guy used up the last of the TP without replacing it.

Any really good solutions for dealing with this sort of thing?

 

[jollyreaper]

Here's another question. The instructions I've found so far have been a bit cryptic or only refer to a local machine's security policies. What's the smartest way to set the auditing on the domain level?