spacebass5000
Programmer
I'm more intimate with Linux Security than I am Windows. I need some help here. I am auditing a windows system that I believe has experienced some foul-play.
I need help with the following:
1. How do I tell who has logged on when? I need to know who connected remotely and which user they used.
2. When I went to look in the "Event-Viewer", the "Security" log is completely blank. This can't be right. How would one go about deleting all of this info? How would one go about turning off this logging function (GP?).
3 Could you point me in the direction of some windows security auditing information?
I need help with the following:
1. How do I tell who has logged on when? I need to know who connected remotely and which user they used.
2. When I went to look in the "Event-Viewer", the "Security" log is completely blank. This can't be right. How would one go about deleting all of this info? How would one go about turning off this logging function (GP?).
3 Could you point me in the direction of some windows security auditing information?