NewslettersRelated Resources
EventSource January 2007 – New EventTracker 5.6 and Managing Change in Vista Featured Article Manage Change in Windows Vista Managing change in any network is a daunting task. You have to really know what is happening to be able to understand how your network evolves with use. In Windows, the best way to find out what is going on is to audit all system and user activity. As you probably know, the only way to do this is to use a two-part approach. First, you must create an audit policy. Second, you have to indicate which objects and which users you want to audit. Turning on the audit policy is done through either the Local Security Policy (LSP) or through Group Policy. You use the Local Security Policy if you want to audit a single computer or if it is part of a workgroup. In previous editions of Windows, you had to put every policy element into a single LSP, but now Windows Vista supports multiple local policies which means that you can create different policies for different users. The real power of policy though lies with Group Policy. That’s because it provides centralized policy deployment to multiple systems—create the policy once and deploy it to any number of systems. Of course, to use Group Policy, you must have an Active Directory and all of the systems you want to control must be members of that domain. This is true for all current versions of Windows, including Windows Vista. With Vista, Group Policy will now contain over 2,450 settings that can be centrally controlled. Despite the fact that Vista now brings 800 new settings to Group Policy management, it has not changed in terms of Audit Policies. It still allows you to audit nine different types of events just as you could in Windows XP and Windows Server 2003 (see Figure 1). Whether you use Group Policy or the LSP, you will need to turn on each of the events you want to monitor. This is only the first part of the auditing process. The second step is to change the security descriptor of the items you want to audit. For example, if you want to audit file access on a given shared folder, you’ll need to view its Properties, then its Security settings and finally, its Advanced Security settings, move to the Audit tab and then select who you want to audit. Fortunately, you can use groups to monitor the activities of all the users in your organization which makes it simpler to assign. You’ll have to repeat this activity on each server or workstation you want to monitor and for each object you need to watch. Audited events are recorded in the Security Event Log and can be seen through the Event Viewer. Since events are recorded locally on each system that is affected, you need to visit each and every system to obtain a global picture of events on your network. This is a bit tedious if you don’t have an event collection mechanism—or a system that automatically collects key events and forwards them to a central location. If you’re using Vista, then you can actually get Vista itself to forward the events. That’s right; Vista’s Event Log can now automatically act on events and send them to a central location, which until the release of Windows Server Codenamed “Longhorn” sometime next year, will have to be another Vista system. In addition, if you’re using Vista, you’ll soon discover that it records a host of events that were unheard of in previous versions of Windows. In these previous versions, Microsoft used a number of different mechanisms to record events. Many products and sub-features of Windows recorded information in their own logs as if they didn’t even know the Event Log existed. It’s no wonder that most administrators didn’t even bother to verify any logs unless an untoward event occurred and they were spurred on by others: security officers for example. It was just too much work. With Vista, most of these tools now record events properly and store them into the Event Log. This is bound to make your life easier, but of course, only when all your systems have been upgraded to Vista. Isn’t that always the case? You have to perform more work to reduce the amount of work you have to do. In our next article, we’ll examine how Vista’s Event Viewer now categorizes events to make it easier to understand what changes have been performed on the system. We’ll also look at how Vista provides detailed information on events, demystifying those arcane numbers and messages you could never understand. Perhaps then, you’ll think it is reason enough to move forward with your migration. About the Authors Industry News New Year, New Threats EventTracker Update EventTracker 5.6 is now available Event Wiz Event: Id 1018 Legal
|
© 2010 Prism Microsystems, Inc. • Privacy • Terms of Use