Hi All,
Basically i want to monitor all the activities of my administrators.
Is there any way I can find out all the activities on a Windows 2000 Server eg:- success / failure logs ,which users had logged on to a server , user creation time ,service stopped at what time, what scripts have been executed, what are the changes made in the group policy etc.
A tool (licenced / free) will also suffice my requirement.
A - Be sure the activities of interest are being monitored. By default only some actions are auditied, add those actions of interest.
B - Server logs (especially 2000) can inundate you with information. Event viewer has filtering capabilities for view but poor for export/save of files.
C - Microsoft knows this and has a 'FREE' tool called Log Parser (current vesion 2.2) comes with a comprehensive help (examples) and runs from the command line.
Before going to 3rd party applications try these to see if it meets your needs.
Good luck.
It is a two edge sword, an Admin would normally have all the powers to remove the tracks. If he knows what he is doing. But there are few things, which can be done
1- Log everything system events + application logs +keyboard taps to another system. Which is not controlled by the same admin group. there are plenty of syslog applications, even free one . Although good key loggers would cost you . Keep the logging system, logically separate than windows environment. I would prefer a Linux machine
2- For system partition create image backup , incremental using software like Norton Ghost. It takes long time, but in case something does go wrong. You can bring another system back in few minutes and do the forensic checks
Dharminder Dargan
Also, you may want to check out a few scripts from, http://www.microsoft.com/technet/scriptcenter/scripts/default.mspx
. There should be some good Admin scripts here that can create some logs for you without having to tweak every good setting within the MSC. This will simplify, plus create exactly what you want. Hope this helps!
Monitoring servers and users can be dangerous.
Be aware not to jump to conclusions!
I use SyslogServer (www.syslogserver.com) to monitor our servers.
I cost $49 in a Small Business edition. It has an agent you can install on the monitored servers. It can post the entries in your event logs to a dedicated syslog server. It can also post entries from almost anykind of logfile.
Best
Ole
Free Guide: Managing storage for virtual environments
Complete a brief survey to get a complimentary 70-page whitepaper featuring the best methods and solutions for your virtual environment, as well as hypervisor-specific management advice from TechTarget experts. Don’t miss out on this exclusive content!
0 pts.
Discuss This Question: 4 Replies