SQL Server Magazine

Access Levels for Security Administrators

Ideally, security-monitoring and administrative responsibilities should be assigned to different people. Here's a framework for the access levels security administrators should have and some recommended tools to help them do their job.

Access Denied

Disabling Logging of Anonymous Logon Events

Do you log anonymous logon events on your servers? Find out how dangerous these events are and whether you can disable or block them from your security logs.

Access Denied

Access Denied, October 2006

Kerberos Ticket Expirations

Find out whether it's normal to log a high number of expired tickets in a short period of time.

Auditing User Account Name Changes

You can discover who made a change if the Audit account management events audit policy was enabled on your DCs at the time of the change.

Locating the User Causing Failures on a Folder

Examining event ID 560 and associated event IDs 528, 540, and 592 will give you the answers you need.

Determining Who Enabled an Account

The answer might lie in the Security event log of your Windows DC.

Distinguishing User Account Reenablements from Creations

User account creations create a telltale pattern in the Security log of event ID 624, followed by several instances of event ID 642 interspersed with event IDs 626 and 628.

Access Denied, April 2006

Get answers to your Windows security questions.

A Cool Log Parser Output Format

The neuroview format makes viewing your Security log output fun.

Access Denied

Every month, Randy Franklin Smith answers your questions about security. Click the links above to see individual Q&As from this month's column.

Logging Domain Policy Changes

In Windows 2000 SP3 and later, event ID 643 once again logs domain policy changes, as it did in Windows NT.

Configuring the Security Log

To avoid missing security events, set the log size to at least 10 MB and have the log always overwrite older events with newer events.

Access Denied

Every month, Randy Franklin Smith answers your questions about security. Click the links above to see individual Q&As from this month's column. Send your questions to Randy at rsmith@ultimatewindowssecurity.com.

Access Denied

Get answers to your Windows security questions

Tracking the Programs Executed on a System

Enable the Audit process tracking audit policy and monitor for event ID 592 to discover which programs have run on a system.

Consolidated Security Event IDs in Windows 2003

In Windows 2003 and Windows XP, Microsoft eliminated event ID 675, event ID 676, and event ID 681 and merged them with their corresponding success events.

Using the Security Log to Determine the Reason for a Logon Failure

If your users’ workstations use Kerberos to authenticate to your DC, event IDs in the Security log won't tell you the cause of any logon failures.