I'm mainly interested in account lockouts, logons attempted under things like built-in administrator accounts, high numbers of logon failures, and any attempts to modify security policies and/or protected groups (such as local admins, domain admins, server ops, and the like). We've also got certain areas where file access is audited.
I use SCOM to try and aggregate the events for me. This is quite handy, as it also monitors things like failed su to root on our ESX servers and other stuff outside of the Windows event logging arena. On 27 July 2010 20:15, Ziots, Edward <ezi...@lifespan.org> wrote: > Hey gang, well I wanted to ask the group, what is everyone doing about > their audit policies on Windows 2008 R2 for domain controllers or member > servers. > > > > I have mapped out all the audit categories and sub-categories, and events, > but I don’t want the logs to turn into soup, so kinda wanted to see what > others were doing for which categories and subcategories they turned on > auditing for. Would be nice to bounce some ideas off about certain events. ( > Already plowed through M$ site descriptions, the Microsoft Security Resource > Kit and Randy Franklin Smith’s Eventlog site) > > > > Feel free to post here, or if you like catch me offline, love to hear the > feedback. After this its on to Firewall rules accordingly for the servers > and either scripting or GPOing that out for a baseline. > > > > Z > > > > Edward E. Ziots > > CISSP, Network +, Security + > > Network Engineer > > Lifespan Organization > > Email:ezi...@lifespan.org <email%3aezi...@lifespan.org> > > Cell:401-639-3505 > > > > > > -- "On two occasions...I have been asked, 'Pray, Mr Babbage, if you put into the machine wrong figures, will the right answers come out?' I am not able rightly to apprehend the kind of confusion of ideas that could provoke such a question." ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
