March 2006 - Posts

A good 3rd-party reference to the Windows security event log
20 March 06 11:31 AM | Eric Fitzgerald | 1 Comments   
Randy Franklin Smith has a site with a very good reference to security event log events. Randy also does training on Windows security log analysis. Read More...
Filed under: ,
Quick Overview of Object Access Auditing in Windows
07 March 06 02:16 PM | Eric Fitzgerald | 1 Comments   
A lot of people are unhappy with object access auditing on Windows, because what they want to know is "who touched the object and what did that person do", but what Windows auditing tells you is actually "who touched the object and what did they ask for Read More...
Filed under: , ,
Default ACLs on Windows Event Logs
01 March 06 10:28 AM | Eric Fitzgerald | 4 Comments   
A question I get asked frequently: what are the default ACLs on Windows event logs? Here's the answer, straight from the source code with only a little formatting help from me, and in more detail than you probably care to know. Windows 2000: Application Read More...
Page view tracker