Full Disclosure mailing list archives
RE: M$ - so what should they do?
From: "Eric Paynter" <eric () arcticbears com>
Date: Mon, 21 Jun 2004 20:31:19 -0700 (PDT)
On Mon, June 21, 2004 6:14 pm, Stuart Fox (DSL AK) said:
You've got some valid points but there is one thing that you've overlooked - auditing.
[...]
Having said that, I've never actually met anyone who uses the registry auditing, but I'm sure they're out there.
I actually knew a group who once tried to use Windows auditing. After working on it for months they gave up. I never got the full details of why, but apparently it doesn't work exactly as expected. Something to do with the fact that in some cases, it logs what you *could have done* rather than what you *actually did*. In other words, if in the audit logs, when it says it granted permission to do something, that doesn't mean you actually did it. Just that you were granted permission to do it, which to many implies that you did it. However, it wouldn't hold up in court as evidence of something having been done.
It tends to be more related to issues such as dll's needing to be registered etc.
Registered where? ;-) -Eric _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: M$ - so what should they do? Stuart Fox (DSL AK) (Jun 21)
- Re: M$ - so what should they do? Valdis . Kletnieks (Jun 21)
- Re: M$ - so what should they do? Todd Burroughs (Jun 22)
- Re: M$ - so what should they do? Valdis . Kletnieks (Jun 22)
- Re: M$ - so what should they do? Todd Burroughs (Jun 22)
- Re: M$ - so what should they do? Aditya, ALD [ Aditya Lalit Deshmukh ] (Jun 22)
- Re: M$ - so what should they do? Duncan Hill (Jun 22)
- Re: M$ - so what should they do? Mohit Muthanna (Jun 22)
- Re: M$ - so what should they do? Ciro Spider-Man (Jun 24)
- <Possible follow-ups>
- RE: M$ - so what should they do? Stuart Fox (DSL AK) (Jun 21)
- RE: M$ - so what should they do? Stuart Fox (DSL AK) (Jun 21)
- RE: M$ - so what should they do? Eric Paynter (Jun 21)
- Re: M$ - so what should they do? tcleary2 (Jun 21)
- Re: M$ - so what should they do? Eric Paynter (Jun 21)
- RE: M$ - so what should they do? Edge, Ronald D (Jun 22)
- RE: M$ - so what should they do? Edge, Ronald D (Jun 22)
- RE: RE: M$ - so what should they do? joe (Jun 22)
- RE: RE: M$ - so what should they do? ktabic (Jun 22)
- Re: RE: M$ - so what should they do? scosol () scosol org (Jun 22)
- RE: RE: M$ - so what should they do? Jonathan Rickman (Jun 22)
- RE: RE: M$ - so what should they do? Frank Knobbe (Jun 22)
- Re: RE: M$ - so what should they do? Georgi Guninski (Jun 23)
- RE: RE: M$ - so what should they do? joe (Jun 22)
- Re: M$ - so what should they do? Valdis . Kletnieks (Jun 21)