WinSecWiki » Comments Feed For Article "Manage auditing and security log"

Django Kalkman

Django Kalkman — Tue, 03 Nov 2009 05:28:04 GMT

Is it possible to delegate the security eventlog of a windows 2008 DC in a windows 2003 domain ?<br />the customsd entry is working on all eventlogs but not on the security eventlog !

RandyFranklinSmith

RandyFranklinSmith — Tue, 03 Nov 2009 07:19:09 GMT

Django, yes - see my revision to this article regarding the wevtutil command

Mariano

Mariano — Wed, 28 Jul 2010 15:40:56 GMT

This policy is the way to access to the security event log without admin privileges, is the best segregation duty escenario.

RandyFranklinSmith

RandyFranklinSmith — Sat, 04 Sep 2010 13:05:13 GMT

Mariano,

Actually the best way is that mentioned above in my article under "To delegate...". This privilege gives you more ability to view to the security log. Also, taking it away from admins doesn't really restrict them since they can always give it back to themselves so no real separation of duty.