W2K Server -->Event Viewer --> Security Log

[rwilliams3]

Server background:
*Windows 2000 Small Business Server (SP3)
*1.3 gb RAM
*Pentium III 1.4 GHz processor
*Exchange 2000 (SP3)
*SQL 2000 (SP2)

My Security Log section of the Event Viewer is showing with only one entry? The one and only entry is shown below:

Event Type: Success Audit
Event Source: Security
Event Category: System Event
Event ID: 517
Date: 10/24/2002
Time: 3:07:18 PM
User: NT AUTHORITY\SYSTEM
Computer: ISBNT2
Description:
The audit log was cleared
Primary User Name: SYSTEM
Primary Domain: NT AUTHORITY
Primary Logon ID: (0x0,0x3E7)
Client User Name: Administrator
Client Domain: ISB
Client Logon ID: (0x0,0x1A2F2BD)

I don't remember clearing the log, but I might have? But that doesn't explain why there have been any new entries?

Does this look like a hacker? I haven't had any problems with the server (except a reoccuring PerfLib event ID 1010).

How can I turn the security logging back on?

Russell
frw3@yahoo.com

 

[rwilliams3]

Turnned on logging using steps in:

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q300958&sd=tech

Russell