Announcement

Collapse
No announcement yet.

Auditing not working properly

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Auditing not working properly

    OK here goes I have a client that caught an administrator(there is more than one) making changes to files and directories and user accounts but said he had done nothing. We had logs of him making the changes and put him on probation. The admin then changed something in auditing or events so that when you add or delete a user you only get that the user was modified or deleted and it says system did it instead of the person actually doing the modifications.

    I know it is not much to go on. The domain is 2008 r2 and in 2008 mode. Any ideas would be greatly appreciated.

  • #2
    Re: Auditing not working properly

    get an external auditing company in.

    You're talking about someone in a designated position of trust, who has the ability to, so far, bypass security controls put in place.
    Because there doesn't seem to be any other people in the organisation who have the requisite technical skill to handle the issue, you need someone who can.

    Ideally, do it without telling the rogue SA.
    Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

    Comment


    • #3
      Re: Auditing not working properly

      I been using this application for some time already and its working great, its logging any change that was made to any file that you want to monitor.

      http://www.greyware.com/software/sys...g/3x/index.asp

      Hope it helps!

      Comment


      • #4
        Re: Auditing not working properly

        dimanaz, looks like a good tool, however it won't help with retroactive auditing..
        Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

        Comment

        Working...
        X