Security Basics mailing list archives

RE: IP-adresses in Windows 2000 event log


From: "John Tolmachoff" <sflist-secbasic () reliance net>
Date: Fri, 21 Feb 2003 09:48:19 -0800

Is there any way to change the settings of a domain controller's event
logging system, so that the system stores the client's ip-adress whenever
a client tries to logon to the server. Basic logging is already possible,
but if the client machine is not part of the domain (for example a
hacker's computer), only the machine's NetBIOS name is stored, which is
quite unsatisfying.

I believe you will have to use other products for more detailed logging.
Things like M$ MOM can do that.

John Tolmachoff MCSE, CSSA
IT Manager, Network Engineer
RelianceSoft, Inc.
Fullerton, CA  92835
www.reliancesoft.com




Current thread: