Windows XP Professional & Server 2003 Administration: Part 7

Table of Contents

1. Main Menu
2. Part 7: Manage User Profiles and Authentication
3. 7.1: Managing User Profiles
4. Video: Create and Manage User Profiles
5. 7.2: Securing Authentication in Active Directory
6. 7.2.2: Audit Policy
7. 7.2.3: The Event Viewer
8. Review Questions for Part 7

7.2.2: Audit Policy

Audit policy settings provide the ability to track the success and failure of various authentication related events. Unlike 2000, server 2003 domain controllers have a number of audit settings configured by default through the Domain Controllers policy.

The following are authentication related audit policy settings:

• Audit Account Logon Events: Intended mainly for Domain Controllers which authenticate users as they log on to other computers and records each instance of a user logging on

• Audit Account Management: Records local account management events on a Member Server, such as creating, modifying or deleting a user object.

• Audit Logon Events: Used to record users logging on or off of their local computer and helps track which user was accessing the computer when a specific event occurred

• Audit Object Access: Used to monitor a resource such as file, folder or registry key once auditing is enabled

• Audit Policy Changes: Helps track changes by an Administrator to a computers security configuration

All audited events are recorded in the Security log of the Event Viewer and can be read by a member of the Administrators group.

The following screen shot shows the default Domain Security Policy Settings