Enabling Security Logging

By Jesse Franklin

Enabling Security Logging is a bit tricky, but it is worth the effort. Just follow these simple steps and you will be able to view security events such as users' account logon events, changed permissions on shared folders, and many more security conscience events.

Right-click Security, then go to View, and make sure All Records is marked instead of Filter. This will allow all of the chosen security events to be shown in Event Viewer. Review our article on the Microsoft Management Console so be sure you know how to add/remove a snap-in. To enable security events we will add a snap-in called Local Computer Policy.

Make sure you have administrative access or this will not work. Follow this path and we will be finished soon. Double-click Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, Local Policies, and finally Audit Policy. Right-click the policy you want to enable. Choose the settings you want, and then click OK. Repeat this step for all policies you want to enable. Now when you go to the Event Viewer and click on Security, you can view your computer's security logs. If the sight of Local Computer Policy was too much technical jargon to bear, it will not hurt to remove it from your console.

You can also right-click on Security and click Help. Type Security in the box and read all about it until it makes perfect sense. I recommend reading about security before enabling it because there are a lot of risky changes to be made within the Local Computer Policy snap-in.

References:
Microsoft Management Console.

Article last reviewed: 03/04/2004

del.icio.us

Created by: Digital Foundation, inc.

All content of the NetworkClue website is copyrighted. Articles, notes, outlines, and all other materials may not be stored on the Internet or sold or placed by themselves or with other material in any electronic or printed format in whole or part. However materials may be referenced by links to the site.