Audit Logging Registry Settings 2

[SRotblat]

I'm trying to work on a plan to lock down about 40 PCs running WinXP. THese are NOT on a domain (not my choice) and I'm searching for ways of enabling the audit lodding via the registry to limit the need to walk around to each PC and do the settings via the GP editor by hand. The reg file would be put into the logon scripts (Novell) for the PCs.

I'm looking for specific keys and values to set auditing, and if possible options for length of logs, log location, etc.

Thanks

 

[linney]

Try here.

How To Determine Audit Policies from the Registry

http://support.microsoft.com/default.aspx?scid=kb;EN-US;q246120

Q310516 HOW TO: Distribute Registry Changes to Computers in Windows XP

http://support.microsoft.com/support/kb/articles/q310/5/16.asp

 

[SRotblat]

Thanks, first link is exactly what I needed

 

[bcastner]

AUDITPOL.EXE - Win2k reskit utility


AuditPol [\\computer] [/enable | /disable] [/help | /?] [/Category:Option] ...

/Enable = Enable audit (default).

/Disable = Disable audit.

Category = System : System events
Logon : Logon/Logoff events
Object : Object access
Privilege : Use of privileges
Process : Process tracking
Policy : Security policy changes
Sam : SAM changes

Option = Success : Audit success events
Failure : Audit failure events
All : Audit success and failure events
None : Do not audit these events


Samples are as follows:

AUDITPOL \\MyComputer
AUDITPOL \\MyComputer /enable /system:all /object:failure
AUDITPOL \\MyComputer /disable
AUDITPOL /logon:failure /system:all /sam:success /privilege:none

Direct download:

http://www.dynawell.com/reskit/microsoft/win2000/auditpol.zip

AUDITPOL /HELP | MORE displays Help one screen at a time.