Auditing Windows 2000

Auditing, or the ability to track security events in the Windows NT security log, is a valuable tool for helping you maintain the security of your systems. Microsoft has improved on NT's auditing features with Windows 2000, which offers significant enhancements. In addition to NT’s seven categories of audit events, Win2K provides two new categories to track additional areas of activity. Let's take a close look at Win2K's auditing capabilities and see how they differ from NT's.

Configuring Audit Policy
Like NT, Win2K’s default audit policy disables each audit category, so the security log is empty on a freshly installed system. Unlike NT, you don't use User Manager to enable auditing in Win2K. In fact, User Manager doesn’t work in Win2K domains. Instead, you use the Active Directory (AD) Group Policy to enable auditing. For information on Group Policy and Win2K's configuration process, see my column "Group Policy". . . .

Great article.

Matthew Brown August 30, 2000

I looked all over MS's website for this information, couldn't find it. Good stuff!

Russ Sinclair April 04, 2001

Fantastic article. I will definitely send my students here when they are in need of additional information. Keep up the GREAT work! 

CyndiKaye January 17, 2002

I had always wondered why any article related to computer / IT should be really difficult to understand. Here for the first time, I don't feel stressed while reading it. Excellent job, keep it up. 

Hemant April 23, 2002

Articles such as this are 'lifesavers'. Instead of weeding through numerous sources (Microsoft's included) and sorting out that which is needed to begin the planning phase, here is a short, consice, summary. THIS is what we should ALL be offering eachother. EX-cellent!

Matt Brainerd December 05, 2002

Actually, a statement in this article is incorrect:

"Win2K preserves all of NT's auditing functionality and offers some exciting new capabilities."

You will notice in Logon/Logoff events (Event 540's), if it says Kerberos as the authentication package, Windows 2000 does NOT log "source" Workstation name information where the logon occured. So, admins can no longer tell which workstation a logon occured from. Check for yourself and you will see I am right.

Kerberos is Windows 2000's native authentication protocol. If NTLM is the authentication package used, the workstation name IS displayed. Don't get rid of your Windows 9x machines everyone, otherwise you won't be able to tell who logs in where!

Way to go Microsoft!

Jason Bennett January 17, 2003

I keep finding articles that talk about auditing win2k or nt4 but nothing that covers auditing win2k clients on an NT4 domain. I am trying to do that but I have found that failed logon attempts are not being logged at the NT domain controller. If I try three times I get my account locked out and that appears in the Audit log (on the DC) but the first two tries don't. I enabled auditing on the win2k client and it logs all (failed) attempts but the DC still doesn't see them. Is this related to the NTLM mode? Has anyone seen this problem?

Ron West March 11, 2003

You must log on before posting a comment.

If you don't have a username & password, please register now.