windows security log doesn't have any entry

22 Sep 2006 4:05 AM

msft

Hi,

I am very concern. My windows 2000 and windows xp machine's security log
are empty. I check the properties and it all seems to be fine. I try to
restore all default settings and filter for all events. Still the security
logs are empty.

Is there something that can be done to fix it? I am very concern if the
system have been temper with to keep unauthorize log-in from being recorded
in the security log.

Pleaes note, its only the security log thats always empty in the event
viewer; The application and system logs seems to be fine.

Please help and provide your insite.

Thanks.

22 Sep 2006 4:07 PM

PC

You need to enable the events you want to audit in the security log.
Go into your MMC and add the group policy object snap-in, then go into
your local security setting, local policies, audit policy and set each
event to audit success or failure.

msft wrote:
Show quoteHide quote

> Hi,
>
> I am very concern. My windows 2000 and windows xp machine's security log
> are empty. I check the properties and it all seems to be fine. I try to
> restore all default settings and filter for all events. Still the security
> logs are empty.
>
> Is there something that can be done to fix it? I am very concern if the
> system have been temper with to keep unauthorize log-in from being recorded
> in the security log.
>
> Pleaes note, its only the security log thats always empty in the event
> viewer; The application and system logs seems to be fine.
>
>
> Please help and provide your insite.
>
> Thanks.

24 Sep 2006 5:21 PM

Karl Levinson, mvp

.... and then if you're interested in audit logs of access to files, you have
to also enable that in the security tab of the files and folders you wish to
audit. More info on auditing:

http://securityadmin.info/faq.asp?auditing

--
kind regards,
Karl Levinson, MS MVP
Security FAQ site:
http://securityadmin.info/faq.asp

Show quoteHide quote

"PC" <p51***@hotmail.com> wrote in message
news:1158941234.191578.25930@d34g2000cwd.googlegroups.com...
> You need to enable the events you want to audit in the security log.
> Go into your MMC and add the group policy object snap-in, then go into
> your local security setting, local policies, audit policy and set each
> event to audit success or failure.
>
>
> msft wrote:
>> Hi,
>>
>> I am very concern. My windows 2000 and windows xp machine's security log
>> are empty. I check the properties and it all seems to be fine. I try to
>> restore all default settings and filter for all events. Still the
>> security
>> logs are empty.
>>
>> Is there something that can be done to fix it? I am very concern if the
>> system have been temper with to keep unauthorize log-in from being
>> recorded
>> in the security log.
>>
>> Pleaes note, its only the security log thats always empty in the event
>> viewer; The application and system logs seems to be fine.
>>
>>
>> Please help and provide your insite.
>>
>> Thanks.
>