May 2007 - Posts

The Trouble With Logoff Events
08 May 07 01:37 PM | Eric Fitzgerald | 1 Comments   
A lot of you guys probably are using your SEM/SEIM systems to record logon and logoff activity without much of a second thought. I just thought I'd bring one problem to your attention. Logoff events are not strictly reliable. From an engineering sense Read More...
Filed under: , ,
Enumerating Stuff in AD when all you see is GUIDs in Audit Records
03 May 07 01:19 PM | Eric Fitzgerald | 0 Comments   
A lot of things in Active Directory audit events show up as GUIDs but are not translated. Why is that? Well, we only translate one kind of AD guid, the objectGUID. However AD uses GUIDs in several ways. For instance, group policy objects have a common Read More...
Filed under:
Auditing the Creation of Domain Controllers
03 May 07 11:36 AM | Eric Fitzgerald | 0 Comments   
Special thanks to Raman in the Active Directory team for this one. Ever want to audit the creation of new domain controllers in your environment? Yeah, me neither :-) However if you ever want to, here's how. 1. The default SACL on Active Directory should Read More...
Filed under:
Page view tracker