File Auditing properties issue

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Anti-Phishing Toolbar Available http://toolbar.netcraft.com/ Lecter "Trust No One!" Tag: File Auditing properties issue Tag: 69239
  - 2
    - LC2003 - certificate is not valid Live communications Server 2003 does not stop. Any help is apreciated Event Type: Error Event Source: Live Communications Server Event Category: (1001) Event ID: 14347 Date: 3/23/2005 Time: 8:26:21 AM User: N/A Computer: FMA001 Description: Unable to listen for Transport:TLS, IP address:0.0.0.0, Port:5061. Error:0x800b0101 (A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. ). For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp. Tag: File Auditing properties issue Tag: 69237
  - 3
    - Minimum rights for VB code signing What are the minimum rights needed on a workstation (XPSP2) to request and use a code-signing certificate from a domain-local CA? As Administrator I can request and use a code signing certificate, as a user I cannot. Since I do not want to work as admin all the time I would like to know what rights I need to have (machine or domain) to sign code as I develop it. Carol Chisholm Tag: File Auditing properties issue Tag: 69233
  - 4
    - Spyware & Registry changes I use Spybot S & D and it gets rid of syware well. I recently formatted my hard drive and all is well, but....Having downloaded S & D (updated version) onto my laptop after formatting HD,it is now identifying spyware it can't remove, all of which is embedded in the Registry. Examples are: ISearchTech.PowerScan entry HKEY_USERS\S-1-5-18\Software\PowerScan DyFuCA.InternetOptimizer entry HKEY_USERS\.DEFAULT\Software\Policies\Avenue Media I can delete them manually from regedit I imagine, but if S & D can't, should I? I am having some irritating but harmless events such as Dial up prompt and a web page (blank when on or off line) called sixty six appearing shortly after I switch on. Can anyone help? Tag: File Auditing properties issue Tag: 69231
  - 5
    - Delete File A spyware program deleted all the files in the VCom directory except 5 files which have spyware attached These 5 files I need to delete but can not find a way. The VCom was for my Firewall and Virus detection Tag: File Auditing properties issue Tag: 69219
  - 6
    - Follow up to tracking permission changes thread. I posted earlier about tracking whenever someone changes the permissions of a given object. Here's what I've done so far. I verified in the Local Security Settings that Successful and Failed is set on Local Policies | Audit Policies | Audit Policy Change and Audit Provilege Use. For a given object, in Properties | Security | Advanced | Auditing, I have the Everyone group configured for Full Control and every Successful and Failed check box is checked Yes, I know what I did generates a lot of log entries. I've opened it up because I've never seen a log entry for a permission change work before. So to test I go to c:\temp and verify the above settings are propagated to that folder. Inside c:\temp there is a file called test.txt. I verified the settings have propagated to that file. I then logoff, logon as a different user, and then change permissions, change ownership, modify existing permissions, add and remove groups and users, and then logoff. When I log back on as an administrator to read the security log, there is not one log entry that says anywhere in the description that something associated with c:\temp\test.txt got changed. Any suggestions/help is greatly appreciated!!! Tag: File Auditing properties issue Tag: 69215
  - 7
    - Track Remote Desktop Connections? We have Windows 2000 servers that can be accessed with proper admin password through Win XP Remote Desktop Connection on client computers. Only users that have the password can log in remotely, however is there anyway to track or tell if a remote connection is made? Does the server (Windows 2000) log this type of connection in the Event Viewer anywhere, or anywhere else? Thanks for your help! -Joe Tag: File Auditing properties issue Tag: 69211
  - 8
    - i have been hacked Hi im from colombia, i have a very bgi problem , my count was hacked..i think that they did it trough a keylogger i need the information that i have in my count, someone can help me? Tag: File Auditing properties issue Tag: 69208
  - 9
    - i have been hacked Hi im from colombia, i have a very bgi problem , my count was hacked..i think that they did it trough a keylogger i need the information that i have in my count, someone can help me? Tag: File Auditing properties issue Tag: 69207
  - 10
    - Creating a registration authority for Windows Server 2003 How do you create an RA in a DMZ on a non domain computer to send certificate requests to an internal issuing enterprise CA? Thanks, RJ Tag: File Auditing properties issue Tag: 69205
  - 11
    - [?]Secpol.msc How do I use Secpol.msc IP Security Policies To Deny Bad Blocks which I specify As well as filter/forward/deny certian ports? Tag: File Auditing properties issue Tag: 69203
  - 12
    - change password every 90 days How do you create a setting to change user passwords every 90 days on certain Organizational groups? Can someone tell me where to click on a Windows 2003 Server Standard. I am looking for step by step instructions. Tag: File Auditing properties issue Tag: 69195
  - 13
    - Are Multi-Function Printers a Security Risk? Some of my users work as veteranâ??s advocates within Veterans Administration offices across the country. As such they are guests on the VA's network subject to there rules and guidelines. Recently I was informed that they are not allowed to use Multi-Function Printers due to a security risk. They are saying that someone can dial into the MFP Fax, access the attached PC through the printer interface and thus gain access to the network. This sounds a bit far fetched to me. Is this a real possibility? Tag: File Auditing properties issue Tag: 69194
  - 14
    - VSS Project Security Is there any way to get a report from vss showing access by project and download it into an external file. Tag: File Auditing properties issue Tag: 69193
  - 15
    - Encrypt UsernameToken using WS-Policy (WSE 2.0) Hi , How to Encrypt a UsernameToken using WS-Policy. I was able to do that using Code as : SecurityToken token = new UsernameToken(t_username.Text, > t_password.Text, > PasswordOption.SendPlainText); > > > SecurityToken issuerToken = GetServerTokenForEncryption(); > > > // Sign the security token request. > client.RequestSoapContext.Security.Elements.Add( new EncryptedData( > issuerToken, string.Format("#{0}",token.Id )) ); > But how to do the same using Policy. Thanks in Adv. Ravi Dasari Tag: File Auditing properties issue Tag: 69189
  - 16
    - Startup Accounts Using NIS 2004 in XP/SP2. Does creating a restricted account and designating it the startup account provide any internet security or is it simply to deal with multiple users ? I am the only user on the computer. TIA. Tag: File Auditing properties issue Tag: 69183
  - 17
    - Service Pack 2 I am being told by my Service Provider not to install SP2. I am told that it has a lot of problems. From reading about it I think that it has some good features but I'm concerned that if I install it I wont be able to connect to the net. Any comments, I appreciated any experienced in this matter. sam Tag: File Auditing properties issue Tag: 69174
  - 18
    - perfect keylogger bkp.exe this program have the posibility of inserted in any program, sending via smpt information. search this files : bkp.exe bpk.dat norton don`t detect this keylooger ms antispyware beta1 dont detect solucion this problem Tag: File Auditing properties issue Tag: 69171
  - 19
    - FTP access, Userlogin access denied We have an FTP server that users can no longer login to. Also, users within the network are not able to login to the computer with the local policy. The errors give are: "Local policy of sysem does not permit you to login interactively" trying to login to the server with a username and "Could not login to the FTP server with the username and password specified". What is causing this login problem? Local Policy Setting? Tag: File Auditing properties issue Tag: 69166
  - 20
    - OWA Exploit http://www.securiteam.com/windowsntfocus/5EP0E20F6C.html Anyone have a fix for this? Tag: File Auditing properties issue Tag: 69165
  - 21
    - Uninstall z-ball 1 I don't really know where to turn for help on this...I've "googled" but to no avail! One of our (former!!) staff downloaded a lot of "junk" onto his PC, which I have spent a lot of time trying to get rid of. I'm down to one item...apparently a game called z-ball 1.80f. I tried to uninstall it using the add/remove programs in control panel, but it says I don't have access to z-ball\unins000.exe. I can't find such an item on either his hard drive or his network folder. Has anyone ever heard of this and have any idea as to how to get rid of it? Tag: File Auditing properties issue Tag: 69153
  - 22
    - How to disable BHO under winxp sp2? I remember that somebody here said that SP2 will allow us to disable BHOs (although not directly remove them). Does someone know how(where) to acomplish this? Trust No One! Tag: File Auditing properties issue Tag: 69146
  - 23
    - virus i dont know how but i think i have a virus on my p.c. i found the file and also found that if i change what program the file ran on i could open the programs i wanted 2 where before i couldnt open anything...then i used bit defender to delete it now i cant open anything except explorer, IE, microsoft office, connect 2 the internet and thats all i know so far. i cant open anything through explorer or on the desktop except explorer and IE but nothing else at all opens. messenger, and of my anti-viruses nothing so if anyone can help or suggest a way to get rid of the virus would be helpful...thanks Tag: File Auditing properties issue Tag: 69145
  - 24
    - How to avoid router broadcast to windows clients? Hi all, Last week we had somebody at our LAN plugging an ADSL router configured with Ip address 192.168.1.1 and RIP v1 , of course the router started to broadcast it's presence ... Most if not all Workstations accepted the broadcast and took 192.168.1.1 as their GW instead of the DHCP supplied one even the one with SP2 FW .. Needless to say that it was a chaos . Is this a normal behaviour ? ( 192.168.1.1 is Not in the subnet of the Lan interface of the PC !) what can I do to avoid that in the future ? Thanks in advance for any ideas / feedbacks. Best regards, Berni Tag: File Auditing properties issue Tag: 69144
  - 25
    - Windows Update vs. SUS This should be an easy one. I currently use SUS for applying updates with the Severity of 'Critical'...this seems to be working fine. However, after SUS has updated the machines (and they have successfully rebooted) and I have verified that the updates have been applied by using the MBSA (identifying the SUS server as the source); if I have the machine go out to the Windows Update site, it is identifying that there are still critical updates that need to be applied. When I look at the technical aspects of one of the "missing" critical updates - the severity is "important" not critical. Example:MS04-041 (885836) The technical site for this update shows that it has a Maximum Severity Rating of "Important".....But, when Windows Update performs a scan for updates - the 885836 is showing as "critical". Can someone clairify this for me please? Tag: File Auditing properties issue Tag: 69138
- Next
  - 1
    - Logon Scripts with Windows Firewall I have just installed 10 new Windows XP Workstations with Service Pack 2 replacing older ones running Windows 98 Second Edition. The Server is running Windows Server 2000. When logging onto the Domain with the new workstations, the logon script (defined in the users profile) do not execute. After doing some initial troubleshooting, I discovered if the Windows Firewall was disable the logon script worked. The logon script is a batch file. Tag: File Auditing properties issue Tag: 69125
  - 2
    - Network security. I am part of a smaller network (25 or so). It is my understanding that i am not supposed to give out my log-on password to anyone. This keeps my PC secure. This is why the password tab on the server for me comes up with astricks. If they want into my PC they (the administrator of the network) should have the local password for my PC. Is this right or should I give up my password? Tag: File Auditing properties issue Tag: 69117
  - 3
    - windows explorer runs spontaniuosly in backround killing my memory Hi all Is any one familiar with this phenomena?? On windows start up (windowsXP professional sp1), windows explorer exe (explorer.exe) start's up as well. It run's on the back ground consuming growing amount of memory. After killing it's process through task manager task bar is immediatly gone... but i am able to continue working with applications that were already runing. Any idea what's going on or how shell i handle this? Thanks in advance Rea Tag: File Auditing properties issue Tag: 69111
  - 4
    - Anti virus software? I keep hearing on the radio and other places that without anti-virus software (PC-cillin, Norton, or some other) a PC computer connected to the internet will get a virus within a couple minutes. I've been using the internet for several years now with no virus protection and haven't detected any viruses on my Windows 95 system. Is it possible the new viruses today will not run on an old Win 95 setup and I don't have to worry about it, or should I install a firewall and anti-virus software for added protection. How would I know if a virus is on my system? Everything seems to work ok. -Bill Tag: File Auditing properties issue Tag: 69105
  - 5
    - smileycentral spyware via 'good luck' email? I recently forwarded a 'funny' email from a relative. When I opened it, I was hit with the MSIE notification I was about to visit a secure website. Since there is no way to say "NO!" to this notification, I forced Outlook to close via Task Manager. I later saved the message as a msg file and inspected the HTML part. It was a 'pass it on and have good luck' message filled with references to smileycentral.com, both to web pages and .gif files. But none of these addresses were HTTPS. The only thing I can figure is that one of the image files was being redirected to a secure site. What would be the purpose of this? Is there a vulnerability in Outlook 2000/MSIE that would allow smileycentral to install spyware via such an email? thanks, nf Tag: File Auditing properties issue Tag: 69102
  - 6
    - software to remove IE toolbar or BHO? My IE have too many toolbars installed. It's slowdown my system and IE, there is any way to get rid of this toolbars or BHOs? Thanks in advance! Tag: File Auditing properties issue Tag: 69101
  - 7
    - Avast 4 Home Anti-virus Hi, I de-installed my Norton 2003 and installed Avast 4 Home instead, however, it messed up my settings for emails and internet. I could no longer get my messages and when I was trying to open Internet explorer, I was getting that page where it says that the page is missing. I received the keys from Avast and have 60 days to register Avast. My question is if I register it and get updates, is it going to mess up my emails and internet settings? I had to call my ISP to help me in solving the problem and spent over 45 minutes. So I don't feel like going through this again. Let me know your comments. I have the following software installed: Windows 98 Outlook Express Internet Explorer Avast 4 Zone Alarm Ad-aware Spybot- Search & Destroy Thanks, Christie Tag: File Auditing properties issue Tag: 69096
  - 8
    - Remote Desktop secure I have to administer my bussines servers from home. I always use a vpn for it. My question is: is remote desktop only (without vpn) as secure provided that high secure policy is used? Tag: File Auditing properties issue Tag: 69094
  - 9
    - antispyware hi, i need an antispyware prog. wich is the best, most effective, freeware aswell? thanks senti Tag: File Auditing properties issue Tag: 69087
  - 10
    - outlook user/password in clear I notice that when I use my outlook 2000 sp1 with XP I can see the user name and password in the clear as it goes to the SBC sever they say it is a M/S problem or I have a password cracker allowing it to go out that way. Well I know I have no cracker sw. fresh install. Is this the way outlook normally sends out user/password or maybe Iam missing a setting. Tag: File Auditing properties issue Tag: 69082
  - 11
    - Repeatedly rcvg update KB837009 Outlook Express 6 Over the past several months, I'v received the Cumulative Security Update for Outlook Express 6 Service Pack KB837009 over and over. I've apparently downloaded it successfully numerous times, but it keeps coming every few days. I'm running Window 98 SE on a Pentium II. Tag: File Auditing properties issue Tag: 69080
  - 12
    - explorer redirects to google and eventually disconnects from inter Using Windows XP. Anti-spyware does not detect any problems, nor does virus software, yet internet explorer 6 consistently attempts to redirect to google or other web sites, and eventually terminates connection to the internet (cable connection). I have to reboot the computer every time to get back to the internet. 15 or 20 minutes later, it happens again. Any suggestions? Tag: File Auditing properties issue Tag: 69067
  - 13
    - connecting to another server Hi, I've recently taken over the network at our business and I'm flying by the seat of my pants on how to do some of the networking tasks and such. We connect remotely to an afp server to upload files for printing. For some reason that I can't determine, the service is not working properly. I recently (within the last month) ran windows update on one of our two servers (both of which are runing windows server 2003 standard edition). Is this affecting a firewall somehow? If so, where are the firewall settings located so at the very least I can turn it off long enough to transfer, then turn it back on? Additionally, if there is a way to list set locations on a safe list, I would like to be able to do that so in the future we do not have this problem If it makes any difference, the computer I'm trying to transfer from is a Mac. Something else I noticed that I'm not sure may or may not affect the operation of our system is that one server shows updates on automatic updates and the other doesn't. Should the two be running on the same service pack updates for the optimum compatibility? Any help would be appreciated. Thanks, Jessica Tag: File Auditing properties issue Tag: 69059
  - 14
    - Deleting Unwanted Programs HELP...Please. When I go to the add or remove area of my Control Panel to remove three unwanted programs that are listed there (Shopping Wizard, Search Extender, and Home Search Assistent), I am directed to a website with mis-spelled words and it will not un-install these programs. Please help! I don't know how to get these off of my computer. Thanks in advance! -- Star Tag: File Auditing properties issue Tag: 69053
  - 15
    - Complex Password policy doesn't set under the CP Applet..works fine from MMC has anyone else come across this? Standalone W2k Pro computer. Local Policy is set to ENFORCE STRONG PASSWORDS. It will restrict blank passwords in the MMC, but if you use the user and password applet under the control panel it doesn't restrict it. Any ideas? Thanks awonders-at-aharinc.-dot-.com Tag: File Auditing properties issue Tag: 69052
  - 16
    - Requesting a Certificate with Mutilple Common Names How do I request a certificate with multiple CNs using IIS certificate request wizard? The CA is a sub-ordinate root CA running Microsoft Certificate Server which is bundled with Server 2003 Std. Edition Tag: File Auditing properties issue Tag: 69048
  - 17
    - File access auditing fills security log too fast I am attempting to enable file and application auditing to meet HIPAA compliance. The issue I am having is the security log fills up way to fast, eventually locking out all but administrators from logging on. I know I can disable this, but I would rather just audit when the file or app was accessed and by whom. I have been experimenting with the auditing settings, but no matter what I do, even opening one folder creates 10 security items in the event log. Does anyone have any tips on how to narrow down what is entered into the event log? Tag: File Auditing properties issue Tag: 69047
  - 18
    - CRL is unavailable or expired on any VALID S/MIME Signature is there any solution out there? I still get this error message on outlook XP on W2k (clicking S/MIME Signature Propeties)... something like ... http://support.microsoft.com/?kbid=284977 any idea how to fix this ? configuration error? Tag: File Auditing properties issue Tag: 69044
  - 19
    - EFS -- Encrypting File System -- File recovery on another computer I cannot find a web page that shows how to recover EFS encrypted files on another computer. Tag: File Auditing properties issue Tag: 69040
  - 20
    - virus alert hi all, while surfing the net my avg alerted me saying a virus had been detected but before i could read the whole message a friend closed the window, so i did a scan and nothing was detected. is it possible that something is sill there and just went undetected by my avg (my antivirus software) if so, is there anything i can do myself to locate and identify any possible virus. thank you. Tag: File Auditing properties issue Tag: 69034
  - 21
    - Certificate Server Web Server Template Please help I am trying to add a web Server Ceritificate Template to my Cisco ACS server. I am running CA on a Windows 2k3 box. When I pick Web Server as my template I should be able to pick Microsoft Base Cryptographic Provider V1.0 as my CSP. I don't get that choice. Please help Tag: File Auditing properties issue Tag: 69032
  - 22
    - Event ID 538 not recorded for user logoffs. Hello, When looking at the Security log (W2K, SP4), I see the 528 event for when a user logs on but I'm not seeing a matching 538 for the logoff. I've double-checked the Local Security Policy | Local Policies | Audit Policies | Audit Logon Events and both the effective setting and local settings are set to Success and Failure. In... http://www.microsoft.com/technet/prodtechnol/windows2000serv/maintain/monitor/logonoff.mspx ...this is described as a bug but that isn't very helpful. Does anyone know more as to why this is happening? Is there a fix? or is this something I have to deal with? Thanks! Tag: File Auditing properties issue Tag: 69031
  - 23
    - cant get into email account I recently got my hard drive cleaned up and debugged at a local computer store. Ever since then, although everything else is working perfectly and much faster than before, I can no longer get into my email account. My daughter can get into hers. Mine is an Excite account, and although I can access the general Excite site, I cannot access my email account. The message reads that cookes and javascript have been disabled. I have no idea how to fix it. I phoned the computer store and they said that they could not walk me through it on the phone, that I would have to bring the hard drive back in again. I live about an hour and a half's drive away from the store, and it makes it difficult to do so right away. Is there any help or adivce that anyone here can give me? I miss being able to send and read my mail. Thank you. Tag: File Auditing properties issue Tag: 69027
  - 24
    - Possible Email Attack Using Microsoft Received email purporting to be from www.communication3.msn.com urging me to click on link to initiate Windows Update Service. Link included what appeared to be complex identifier. I called Redmond, but couldn't get past frontdesk. Lady (nice lady) explained I had to forward email or to fax a copy. I explained that I would not (ever) open it in my computer because of potential security risk I perceived. Don't know if this is "real threat", but this is the only way I can think to alert community. Tag: File Auditing properties issue Tag: 69018
  - 25
    - Is there an MS Patch Matrix available? Is there a resource somewhere that lays out all MS KB Patches by O/S ? I've looked in the Security section for 2 hours to no avail and would just like to know which patches are for NT4, 2000 Server, 2003, etc. without having to weed through 100's of clicks to compile it all.... TIA, -Bill Tag: File Auditing properties issue Tag: 69017

A fellow IT worker at another organization also working on HIPAA is having
the following issue while trying to enable file auditing:
"Folder"/Properties/Security/Advanced/Auditing/"Object settings"
The "Apply onto:" box (second selection down) is greyed out. How can this
be enabled? I have no problem on any of the workstations in my organization,
I have tried this under admin and user accounts, but the box is always
available.
Any ideas?

Top

Re: File Auditing properties issue by Roger

Roger
Thu Mar 24 09:15:46 CST 2005

When settings in the NTFS dialog are greyed out it is usually
because that specific setting value is being inherited.
So, this fellow IT worker, when in that dialog at the point you
have outlined, does first click on one of the listed principals
so that the "Apply onto" box and other checkboxes are being
used to display a specific ACE of the control list ?
If so, are not at least some of the checkboxes also grey for
that ACE ? If so, an inherited setting is being displayed.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"ParamusAdmin" <ParamusAdmin@discussions.microsoft.com> wrote in message
news:B8055273-C49C-4591-815E-8D445662AECF@microsoft.com...
> A fellow IT worker at another organization also working on HIPAA is having
> the following issue while trying to enable file auditing:
> "Folder"/Properties/Security/Advanced/Auditing/"Object settings"
> The "Apply onto:" box (second selection down) is greyed out. How can this
> be enabled? I have no problem on any of the workstations in my
organization,
> I have tried this under admin and user accounts, but the box is always
> available.
> Any ideas?

Top