We will be undergoing scheduled maintenance on May 20th, 2013 at 02:00 GMT.
Microsoft Windows Server 2003 (70-290) Tutorials
Managing Security / Determing Events to Audit
Visitors to VTC.com will be able to view all introductory videos for each training course.
Free Trial Members will gain access to first three chapters for each training course.
Full Access Members have full access to VTC.com�s entire library of video tutorials.
Learn More
Subtitles of the Movie (Microsoft Windows Server 2003 (70-290) / Managing Security / Determing Events to Audit)
If we want to audit access to any files or folders or printers, basically to any resources in the system, then that is the choice that we need to make in our audit policies. We need to audit object access. If we do not audit object access then we can flip as many other switches that we want, we are not going to get reports on files and folders and printers. As we said the auditing is really local. So if we want to audit access files and folders on a particular computer, we really need to set that not only the audit policy but we also need to set the audits at those particular files and folders. I will be talking more of how we do that in just a minute. If we want to audit the management of accounts the privilege use and the policy change, and then those are the choices that we make in our audit policy. We can audit privilege use, we can audit policy change. Privilege use means we did something that a user is not able to do. A policy change means we actually change the security policy which takes even one step further. There are settings for auditing these types of events. If we want to audit users login on and off well logging on and off of what? If we want to audit users login on and off of local accounts then we audit logon. If we want to audit domain accounts then we have got another piece in the **** then we got a domain controller. The domain controller looks for a domain account. So we audit account. We will Take a look at these pieces here in just a minute. But basically you should know for real life as well as for the task these are the main things that we might audit. These are the main general ideas. So when we plan an audit policy we are going to decide the computers to audit and remember that all auditing is local. We can set an audit policy but if we really want to set to audit some files or folders or printers we have got to set the audit those locally. We got to be specific about those. We also need to choose the events to audit. We cannot audit everything. If we did, number 1, nobody will be able to sort through it all. In other words if we have a security log that would have just jam pack full of everything that has happened on the system 24 hours a day, and no focus on what we are looking for then we may not just have anything because nobody is going to look through it all, and number 2, auditing takes resources, takes processor, takes RAM , so we can not audit everything. We also need to decide whether when an audit successes or failures. Really if we think about it auditing failures is more proactive than just auditing successes. If I audit someone success to breach my system, now find out if they succeed. But I will not find out if they are trying. If I audit failure and success they I will find out that they are trying as well. So be very careful on the test as to what they are asking. If they say you want to know if someone succeeds in reaching your system, and that is the audit that you want to put into place then it would just be a success audit it would not do failures. But if they say that you want to proactively audit your system to determine whether someone has attempted to get into your system, then that would be a failure audit and depending on what else they say it could also be a success audit as well. If they say you want to be able to determine whether they have tried and whether they have succeeded then it would be success and failures. If we need to track trends then we need to keep security logs we need to archive security logs and track that information. We talk about that we talk about how to manage security logs. We need to have a person that is in charge of reviewing the security logs. Otherwise what are we doing otherwise why do we have that information there for? So we talked about how we flip of these switches, we talked about making the decision system, what switches we are going to flip. In our section we talk about physically how we flip all these switches for auditing. That is next
Tutorial Information
| Course: | Microsoft Windows Server 2003 (70-290) |
| Author: | Bill Ferguson/Certified Instructor |
| SKU: | 33497 |
| ISBN: | 1932072918 |
| Release Date: | 2004-06-03 |
| Duration: | 8.5 hrs / 107 lessons |
| Captions: | No |
| Compatibility: |
Vista/XP/2000, OS X, Linux QuickTime 7, Flash 8 |
VTC Sign up & Benefits
- Unlimited Access
- 81,350 Video Tutorials (14,200 free)
- Video Available as Flash or QuickTime
- Over 715 Courses
- $30 for One Month Access
- Multi-User Discounts Available
