Security Event Viewer is empty??

[rwilliams3]

On my W2K Small Business Server, when I look in the event viewer there are many entries in the Application Log, System Log, DNS Server, but only one entry in the Security Log showing that the audit log was cleared by System. Event ID # 517

It seems that the security logging has been turned off. How do I turn it back on?

I drilled down to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security and noticed that it looks different than the other ones. I don't want to change anything randomly.

Any suggestions? Thanks,

Russell
frw3@yahoo.com

 

[tahoe2]

Here is a step by step guide on how to utilize W2k Security policies, including Event Log.

http://www.microsoft.com/technet/tr...proddocs/hisdoc/netint/sec_security_audit.asp

Hope this helps.

Corie

 

[rwilliams3]

Will you check that URL? I don't think you posted the correct one? What I'm seeing is Security for SNA and definetly not a step-by-step guide.

Thanks,

Russell

 

[tahoe2]

http://www.microsoft.com/technet/tr...rodtechnol/windows2000serv/howto/seconfig.asp

try this one, I didn't realize the URL doesn't change when going from one topic to another. sorry!

Corie

 

[rwilliams3]

I solved it myself!

Microsoft Knowledge Base Article - 300958 @

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q300958&sd=tech

Go down to the section about Windows 2000-Based Domain Controllers

I made the changes and it recording security events now!

Thanks,

Russell