Event Viewer not recording Security events!!!?????

[zaresa]

I've noticed that Event Viewer is not recording Security Events on ANY of the servers on our network (both NT 4.0 and 2000 machines).

The config settings for all three event logs is identical and I am able to view all events in the System and Application logs.

Is there some additional setting (?) that I need to configure or is there possibly a tool that someone has deployed to erase these logs?


Any help would be greatly appreciated.

 

[jpaf]

You have to enable AUDITING.

Regards
jpaf

 

[zaresa]

Hi jpaf,

Auditing IS (and has been) enabled...the only selection not selected is Start/Shutdown/Restart of System.

Funny thing...I am able to view the Security log on the PDC. However, this is the only machine that I can do so on.

 

[jpaf]

Are you checking auditing by just opening User Manager for the domain (i.e. the PDC)?

Open the local user manager on a server that security log is not working on and make sure auditing is set locally.

Hope this helps
jpaf

 

[zaresa]

We are not using local versions of User Manager (I thought that this was only used on Workgroup machines).

I have been using User Manager for Domains...how can I access or setup a local version of User Manager?

 

[zaresa]

JPAF,

None of our servers have the musrmgr.exe file installed (it is not an available option in Administrative Tools. How can I install this?

Thank you - zaresa

 

[bmm64]

zaresa - having the same problem; auditing is turned on (has been since Win2K servers installed) but lately, there are "gaps" in the security event logs - eg, on server #1 ("PDC&quot there are security events up through 9/26, on server #2 ("BDC&quot there are events from late on 9/26 to 9/27. No events on either from 9/28, 29th or today.

Is this what you are seeing?

Did you recently install SP3 on 2000 servers? I did, and that's seemingly when the issue began.

 

[bmm64]

One more thing: make sure your logs are not filling up! The default size is 512K, I usually set the security log up to 7-10Mb so I can hold 30 days of events. I archive and clear every month.

Size: Event Viewer, left click Security Log, then click (menu bar) Action | Properties to see the size. Can increase size on the fly. If the security log gets full, logons can get denied for some seconds while old events are FIFO'd.