I've enjoyed reading Randy Franklin Smith's articles about the Windows NT Security log (March through August 2000), but I have a question that I haven't been able to find an answer to. My network policy is not to audit workstations (i.e., auditing isn't turned on through User Manager). I want to turn on auditing, and I need to accomplish this task remotely. I have the ability to use a KiXtart script during logon, or I can use Tivoli to send a software package. Is there a way to handle this task remotely? I have more than 3600 workstations in a four-state area. Obviously, sneaker net isn't an option.

Fred Montney 8/10/2000 3:33:24 PM

The first tool that comes to mind is auditpol.exe, a Microsoft Windows NT Server 4.0 Resource Kit utility that lets you set audit policy on remote computers from the command line. Assuming that you have Domain Administrators authority and that the Server service is running on the workstations (it does by default), you can write a simple script that calls Auditpol once for each workstation. If the Server service isn't running, you can call Auditpol from the logon script if your users are members of the local Administrators group on their workstations (which isn't a good idea, by the way). Like any other program that sets audit policy, Auditpol requires you to be running with local Administrator privileges. Bear in mind that you might be able to use Tivoli if the Tivoli agent has Administrator authority on the workstations. (Windows 2000 completely solves this problem with Group Policy.)


--Randy Franklin Smith

Randy Franklin Smith 8/10/2000 3:31:45 PM

Have a look at http://www.heysoft.de/index.htm. The utilities are posted there, plus some similar tools for reporting on other event codes in the EVT files.

Phil Spencley 8/8/2000 12:32:59 PM

Where can I get hold of the R528 and R529 utils?

Rob Williams 8/4/2000 7:42:47 AM