Security Policy Security policy auditing will record attempts to change Audit or Account policies or User Rights. Restart, Shutdown and System Logging shutdowns and restarts can let you know if your server has lost power or been rebooted. This is a good thing to check, as a skilled hacker may be able to cover most tracks, but will usually need to shut down the computer before getting into it. An unscheduled shutdown can be worth looking into. Process Tracking Progress tracking logs program launches, indirect object access, and process exits.
Active servers can accumulate successful process tracking events very quickly.
While setting up the audit is straightforward, it can be difficult to find where the audited events whind up and just what they are saying. In this exercise, you will set an Audit Policy that includes events as well as object access. You will then attempt actions to populate the logs and see what they look like. Click here to go to the beginning of Windows NT environments . Click here to go to the next topic in this section.