Do you find value in tracking WID 4743? Expand / Collapse
Author
Message
Posted 10/25/2016 10:25:56 AM
Forum Newbie

Forum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum NewbieForum Newbie

Group: Forum Members
Last Login: 5/17/2016 3:35:41 PM
Posts: 1, Visits: 0
Is there value in classifying WID 4743 as a security event? We mainly see these when we're dealing with popping computers in and out of the domain. We have fairly tight controls on domain admins thus we're not worried about computers disappearing. We're trying to whittle down what WIDs we alert for.
Post #6277
Posted 11/8/2016 4:33:54 PM
Supreme Being

Supreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme BeingSupreme Being

Group: Moderators
Last Login: 11/14/2013 3:17:47 PM
Posts: 237, Visits: 0
I think the value in this event is purely operational. You may want to track assets that are deleted and created. From a security standpoint I don't know of an attacker activity that may generate this event.
Post #6282
« Prev Topic | Next Topic »


Permissions Expand / Collapse

All times are GMT -5:00, Time now is 4:24pm