Dave
Fri Feb 27 10:42:26 CST 2004
To prevent an unwelcome surprise, r-click the Security Log and open the
properties. Make sure that everything is set appropriately in case you get
an avalanche of entries. You can adjust the size when you see what's going
to happen, but make sure you set the log to overwrite as needed, at least
temporarily. (When you audit login successes, you'll find there are far
more entries than just users entering passwords).
Next, on the Administrative Tools menu, go to Domain Controller Security
Policy. Under Security Settings, go to Local Policies, then Audit Policies.
(If this is not your SBS or another DC, use Domain Security Policy or the
Local Security Policy of the terminal server box. Anything set in the
domain policy, as opposed to the domain controller policy, will be applied
on the workstations as well).
"Larry" <anonymous@discussions.microsoft.com> wrote in message
news:2b1901c3fcaf$806b5520$a401280a@phx.gbl...
> Hi,
> How do you write to/initialize the system security event
> log (in the Event Viewer)? I want to track when people
> log onto the network via Terminal server. Is this the
> place to track this?
>
> (I asked a similar question before but got no replies.
> Hopefully I have explained myself better this time.)