|
|
|
Forum Newbie
Group: Forum Members
Last Login: 2/21/2012 12:17:07 PM
Posts: 5,
Visits: 5
|
|
| I've noticed a massive increase of security events on 2008 R2 DC's compared to 2003. Can anyone shed any light on the new events, the volume of them, etc.?
|
|
|
|
|
Expert
Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326,
Visits: 0
|
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 2/21/2012 12:17:07 PM
Posts: 5,
Visits: 5
|
|
| I don't have any of the new audit categories currently enabled. Are there new sub categories to the 2003 categories? What categorie do the firewall events go under?
|
|
|
|
|
Expert
Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326,
Visits: 0
|
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 2/21/2012 12:17:07 PM
Posts: 5,
Visits: 5
|
|
| Now I understand. I don't have any of the new audit categories turned on, but I do have most of the existing 2003 audit categories turned on, and from what I understand, new sub categories were added to those categories. Thank you!
|
|
|
|
|
Expert
Group: Administrators
Last Login: 4/20/2009 7:57:33 AM
Posts: 326,
Visits: 0
|
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 2/21/2012 12:17:07 PM
Posts: 5,
Visits: 5
|
|
| Is there a way to get a list of all of the categories and subcategories from a 2003 server? On 2008 R2 I ran, auditpol /get /category:* That worked nicely. However, that command does not work with the version of auditpol on 2003. I would LOVE to pull them all into a spreadsheet and compare them. I cannot seem to find any documentation of what subcategories specifically were added. Obviously my objective is to filter as much noise as I can before I collect and archive my security event logs. Thanks, Jim
|
|
|
|
|
Security Log Nerd
Group: Administrators
Last Login: 4/16/2009 1:11:51 PM
Posts: 49,
Visits: 0
|
|
There are no sub categories in Server 2003. The following 9 categories is from our book Windows 2003 Security Log Revealed:
Audit account logon events Audit account management Audit directory service access Audit logon events Audit object access Audit policy change Audit privilege use Audit process tracking Audit system events
|
|
|
|
|
Forum Newbie
Group: Forum Members
Last Login: 2/21/2012 12:17:07 PM
Posts: 5,
Visits: 5
|
|
| Thank you for the clarification!
|
|