The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
109 views

Forward Windows system Event logs to a Linux Syslog Server with no agent

We have a SCOM 2012 server. We have SNARE agents for PCI compliance, but now we want to save money by gathering all events for all Windows servers using its native features. We also have a ...
0
votes
1answer
21 views

auditctl -l not showing rules

I have some rules in the audit.conf file. When do auditctl -l, they don't show up. If I restart the auditd service and do auditctl -l again, then the rules show up. Any idea why this? Where can I ...
0
votes
0answers
13 views

Automate removal of Audit Policy settings

I have a large number of files in the System32 directory that have audit policy settings that were configured directly as well as other audit policy settings that were inherited. I need to remove all ...
1
vote
0answers
45 views

Windows 7 not staying in audit mode after reset

I am creating a custom image for WDS distribution and I'm having some difficulty, I can boot the reference machine into audit mode during the oobe phase with Ctrl+Shift+F3, but when I reset it (for ...
0
votes
0answers
41 views

Windows Audit Mode -cannot login

I am using this link to build a standard image of Windows 7: http://technet.microsoft.com/en-us/library/ee523217%28v=ws.10%29.aspx I got to the Windows Audit Mode point. For some odd reason, when my ...
0
votes
0answers
21 views

Multihop SSH connections not showing up in lastlog

We all know that adding the following to your .ssh/config file will allow seamless ssh hopping through a gateway host: Host *.internal.workdomain.com ProxyCommand ssh gateway.workdomain.com nc %h ...
0
votes
0answers
85 views

Get delete events with file name and user for particular folder

In my windows server 2012 i want to know which files is deleted from a folder by which network user. I want to track delete events only for particular folder. I have done it using group policy and ...
0
votes
0answers
678 views

Windows 7 Security Auditing being turned off - By what?

This has been driving me nuts. I've searched high and low for a solution but have found nothing. I did find this question which I thought held the solution through auditpol.exe. No dice. I can set my ...
1
vote
1answer
2k views

Bully for WPS wireless auditing: is it possible to continue an interrupted --bruteforce PIN test?

Bully is a neat program for wireless auditing: it allows to test WPS PINs against my router or access point so I can know if it is secure enough. Example: $ sudo bully mon0 --bssid 11:22:33:44:55:66 ...
1
vote
2answers
95 views

Linux server configuration audit tool

Is there any tool that validates and checks server configuration? I need something to audit my boxes - if they are well configured and connected to our monitoring (nagios now). Thanks for any ...
0
votes
0answers
95 views

Windows 7 Drive Letter Changed on Data Drive and Can't Log In

I just purchased an SSD for my computer to install the Windows OS files and my program files on, and for my other hard drive for my user directory. I got it all working through an answer file in audit ...
0
votes
0answers
35 views

Meaning of type=BPRM_FCAPS in a ausearch

I and using Linux auditing. In my ausearch results I see entries with type=BPRM_FCAPS Can anyone tell me what they are?
-2
votes
1answer
189 views

Cannot exit audit mode after upgrade to Windows 8

I accidentally entered audit mode from OOBE after upgrading to Windows 8, and now i get this message: . How do i get my system back to usable state?
1
vote
1answer
30 views

Making application visible to software audit tools

I'm writing a software for Windows which is not always installed via msi installer. The software is aimed for business customers. Bigger companies use tools to audit software installed on employee ...
-1
votes
1answer
41 views

Windows File Server audit

I would like to know that how to check out the logs of files and folders deletion on windows server 2008 as well as who did it from where and when?
3
votes
2answers
2k views

Find when password was changed - Windows SBS 2011

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect... I did NOT change this password and I had to ...
1
vote
1answer
386 views

Audit tab in advanced security setting of printer does not appear in Windows 7

I want to audit printer access failures on Windows 7. But when I go to printer properties->security->advanced, there is not Audit tab there. If I try to audit folder, Audit tab is there, but for ...
1
vote
1answer
329 views

Auditd - auditctl rule to monitor dir only (not all sub dir and files etc..)

I am trying to use auditd to monitor changes to a directory. The problem is that when I setup a rule, it monitors the directory I specified, but also all the subdirectories and files underneath it, ...
1
vote
0answers
118 views

Is auditing possible on Windows XP Home Edition?

Although Windows XP Professional has (a lot more) control over Security issues, Windows XP Home Edition does allow the regular user to probe around and allows to set Security settings on folders and ...
1
vote
3answers
1k views

Determine if product key is used on multiple computers

I'm the sole programmer at company. Not only that, I'm the sole person who's remotely computer literate above the "I can check my email". As such, I've been asked to go to all the machines, and ...
3
votes
1answer
95 views

keeping all versions of a directory

I am looking for a tool that can give me a timeline of all changes that where applied to the files in a given directory, together with the contents of all files at any given point. This cannot be ...
3
votes
2answers
287 views

Is there any file check summing software which deals correctly with deep paths?

I have been looking for software which will checksum and verify/compare NTFS volumes with deep paths on Windows, and failing verification on every one I've tried. I've even tried writing my own python ...
0
votes
1answer
121 views

Linux network audit

I have a server with Linux Red-hat Enterprise Edition 5.4 installed. and a client/server application that permits connection at the port 6000, but it doesn't offer connections log. I want to know ...
8
votes
2answers
2k views

File Auditing in Windows

I believe there is no other way to check on a Windows System (for instance Win 7) who has copied or access a file or folder except for enabling File Auditing in the Local Security Policy. Now that ...
0
votes
1answer
237 views

SQL Server: Audit permission denied

Is there any easy way to see those events in SQL Server 2008 for which permission was denied on a query (along with the text of the query and the specific object that permission was denied to)? I ...
2
votes
2answers
3k views

Does Intel centrino advanced-n wifi 6205 support packet injection? (For penetration testing)

Like it says does intel centrino advanced-n wifi 6205 support packet injection? I am a pen tester its not for unauthorized hacking....
1
vote
1answer
68 views

How to find my network and database access [closed]

Our company gets audited pretty regularly and I was wondering if there's an easy way to find out which accounts have access to what on our network? We're an all windows development shop, so all our ...
0
votes
1answer
422 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
1
vote
1answer
105 views

Scheduled Personal Software Audit / Inventory

Im trying to be very pro-active with getting a good backup now as my entire digital life as it were is on my laptop inc music etc. I currently take a USB drive backup and an online backup, however i ...
0
votes
1answer
7k views

How to set CommView to capture a specific wifi instead of the whole channel?

I am trying to experiment with CommView for Wifi. When I start searching for devices their are separated in channels. I click on the one I want and then Capture. As I see the program is capturing the ...
3
votes
2answers
4k views

How do I check if a user connected an external hard drive?

I originally came across this from a Citadel LLC complaint against a former employee. Text of complaint: http://www.scribd.com/doc/63606232/Citadel-vs-Yihao-Ben-Pu From the filing: "Forensic ...
0
votes
2answers
90 views

Windows Network resource access audit

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files) Is there a simple way to have such operations logged?
1
vote
0answers
44 views

Is there a dpkg -C program which actually checks if the files are present in the filesystem?

In other words, read the dpkg database to see if some of the files are missing. I accidentally the system with rm -rf and then quickly hit ^C when I realised what I was doing but I don't know what's ...
2
votes
1answer
2k views

Microsoft Office 2007 license self-audit?

I've been given the task of getting the company I work for into compliance. I currently have 71 users with Office 2007 installed: 35 users on key A 9 users on key B 27 users on key C Here is my ...
1
vote
2answers
826 views

How do I find out when and by whom a particular user was deleted in linux?

I've recently ran into a very odd occurrence on one system I'm using. For no apparent reason, my user account was deleted, although the home directory is still there. I have root access, so I can ...
5
votes
4answers
5k views

How to audit all the software installed on a PC [closed]

one of my customers is going to be audited by a Microsoft partner to check if all the installed software is legal. So far, so good with the software I installed: all the Windows XP machines have ...
0
votes
1answer
204 views

Why are the properties for Audit Policy Disabled?

=I am logged in as an Administrator on my machine and when I check Local Security Settings -> Audit Policy -> Audit Account logon events I click on "Properties" and try to turn it off for "Success" ...
5
votes
1answer
2k views

Windows Security Log and Audit Failures

I was doing some routine maintenance on a Windows Server 2008 box that I manage. When looking at the Security Log in the Windows Event Log interface I see a burst of 50-200 failed logins that happen ...
0
votes
2answers
245 views

To-do list and time-auditing software

Hey, I saw a couple other topics like this but i believe my requirements are a little different. NEED: I'm working on alot of odd jobs for several people and need to keep precise track of the time ...
3
votes
1answer
637 views

How do I audit CD/DVD tray opening events in Windows 7?

Since installing Windows 7, the entire office has experienced random CD tray openings, sometimes while we are in the office, sometimes not. On my PC, I have two disc-reading devices, but only the ...
3
votes
4answers
2k views

Will Windows show a warning if someone tries to guess my password for a lot of times?

To access shared files on my Windonw 7 computer, another person can go through the wireless network and provide the correct user name and password and access those files. I heard a 802.11b or g ...
1
vote
1answer
196 views

How do I find out what my SQL Server database audit records contain?

I need to find out if my SQL Server 2005 database audit records contain the required information that I need. Where or how can I find this out?
2
votes
4answers
113 views

Windows Vista Ultimate Auditing

I am in a position where I might have to prove that I made a certain amount of MB downloads from the Internet including webpages browsed to a court of law. Is there a way of finding this out from ...
3
votes
7answers
900 views

How to tell if a laptop has been used of off the normal network

OK So here is the situation: We have a number of laptops in our organisation. A percentage of the users of these laptops, we beleive never take the laptops out of the building or even out of the ...