Difference between revisions of "Windows"
Jump to navigation
Jump to search
| Line 12: | Line 12: | ||
*[http://www.microsoft.com/technet/security/bestprac/bpent/sec3/monito.mspx events by ID at microsoft] | *[http://www.microsoft.com/technet/security/bestprac/bpent/sec3/monito.mspx events by ID at microsoft] | ||
| + | *[http://www.microsoft.com/downloads/details.aspx?FamilyID=9d467a69-57ff-4ae7-96ee-b18c4790cffd&DisplayLang=en Windows Server 2003 resource kit tools] | ||
Revision as of 13:23, 17 January 2006
"Event Comb" from Microsoft
or
[url]http://www.microsoft.com/technet/security/guidance/secmod144.mspx[/url] [url]http://www.sysinternals.com/ntw2k/freeware/psloglist.shtml[/url] -- PsLogList [url]http://www.gfi.com/lanselm/[/url] -- LanGuard S.E.L.M. -- trial download
Audit Logon/Logoff success events. The logon (528/540) and logoff (538
