The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
13 views

Keeping track of files across two drives

At work, there is a 450GB network drive (X:) which has served as a dumping-ground for 3 of my underfunded NGO's biggest departments. It needs to be reorganized. Depending on a manager's opinion, a ...
0
votes
0answers
17 views

Are there negative consequences to disabling audit policies?

I'm the sole user of my own laptop running Windows 8.1. After doing a bit of research into this (eg. SuperUser question and Microsoft Technet), I can see how this might be useful for a company laptop. ...
2
votes
1answer
31 views

Setting audit policy on any Windows version

Is it possible to set an object audit policy on any version of Windows? I can do it on Enterprise, but wanted to know if it was possible on Home Premium (or any version of Windows without group ...
0
votes
0answers
10 views

Audit logon events with password

I configured my server so it would show audit logon events in case of Failure. Now I want to also record password. Somebody is trying to hack my server. In the event log I only see username which the ...
-1
votes
1answer
44 views

Manually-generated excel files versus computer-generated reports/files

Why is it the data in a user-generated report (e.g., manually encoded journal entries in an excel file) are destroyed once I append or merge them using Audit Command Language or windows cmd? Like for ...
1
vote
1answer
22 views

What are trust services and how can they be disabled?

A recent security audit says that we have machines in our network which are running "trust services such as Rexec, Rlogin and Rshell". It further says that these services can be used to "create a ...
0
votes
0answers
31 views

Auditd - how to exclude one folder?

I'm trying to exclude one folder from auditing, but all my attempts are unsuccessful. Maybe some one can help me? I want to audit: -w /var/www/my-wp-site -k mysite -p wa I need to exclude this ...
0
votes
0answers
62 views

Windows 2012 Server - Audit Who Logged User Off

Is there a way to tell who logged a user off with Windows 2012 Server? For example, I use rdp to log into a box that as multiple admins, there are some scripts that run under a specific user. The ...
0
votes
1answer
97 views

Custom Windows installation and recovery partition with sysprep?

So I do know about the audit mode of Windows, sysprep.exe, and the Windows System Image Manager to create unattended answer files. I already used these tools to setup my new Windows 10 installation, ...
0
votes
1answer
75 views

Tracking file deletion using auditd without unlink?

I'm working on creating an auditd rule that will track the deletion of files and directories. I have one that often turns up in online searches but I'm not sure it is really all that useful: -a ...
0
votes
0answers
260 views

Having trouble rebooting to audit mode after rebooting from audit mode in Windows 10

I install Windows 10. I use CTRL+Shift+F3 to stop OOBE and restart in audit mode. I install some software (Office, etc.), but some of the software requires a restart--like Lenovo Update. I reboot ...
0
votes
0answers
219 views

Pink windows 10 loading screen when loading audit mode in VMWare

When just having installed Windows 10 as a virtual machine in VMWare, and pressing CTRL+SHIFT+F3 to enter the Audit mode. The background of the loading screen is blue at first, but then becomes pink. ...
0
votes
1answer
29 views

How to view all directories with auditing enabled on Windows 7?

A while back I enabled file auditing on a few folders on my Windows 7 machine, but I have forgotten which folders I enabled it on. Is there any way to view a list of all the folders which have at ...
0
votes
0answers
59 views

Auditing entire c:/ drive

I would like to audit my entire c:/ drive in Windows 7. When I Click on My computer > C:/ drive (RMB) > Security > Advanced > Auditing > Add > Administrators I get a permission denied on ...
0
votes
0answers
46 views

File delete audit, Windows 8

I have a shared folder (folderA) and our users must copy some files everyday and after they finish working they have to delete files and when they delete files there must be a record.(for security ...
1
vote
1answer
433 views

URL Logging on home network

I am interested in knowing what websites my teenage boy is going to from his Chromebook connected wireless to my home network. I have been open with him and have told him that I am not censoring him, ...
2
votes
0answers
51 views

How come UAC logs are not being stored in Event Viewer?

In Event Viewer, under Applications and Services Logs, UAC logs are not being stored. How do I enable them? Could Domain/OU group policy have them disabled? If so where can I see that it is disabled ...
0
votes
2answers
41 views

Is there an easy way to retrieve the link speed of network devices?

We have a mix of 100 and 1000mbps cabling in this office with cabling that ranges from ancient home-made cat5 to brand new cat6, and a mish-mash of semi-accessible switches and network segments that ...
0
votes
1answer
118 views

How do I stop recurring error messages from appearing in messages and auditd.log?

On my CentOS linux machine, in my auditd.conf file, I have set my max_log_file_action=keep_logs. However, in my /var/log/messages and /var/log/auditd.log, the following message appears multiple times ...
1
vote
0answers
97 views

how to record all who that login to my linux machines and records them

I installed the package audit on my linux red-hat 6.x machine in order to view the recored of each user that log to my linux machine yum install audit kit installation from: ...
0
votes
1answer
371 views

How can I make cron to email report audit only if there is something to report?

I setup daily cron job checking if files have changed previous day, since those files are not suppose to changed i'm getting empty report, how can i change it to send email prevent this. this is my ...
0
votes
1answer
2k views

Forward Windows system Event logs to a Linux Syslog Server with no agent

We have a SCOM 2012 server. We have SNARE agents for PCI compliance, but now we want to save money by gathering all events for all Windows servers using its native features. We also have a ...
0
votes
1answer
86 views

auditctl -l not showing rules

I have some rules in the audit.conf file. When do auditctl -l, they don't show up. If I restart the auditd service and do auditctl -l again, then the rules show up. Any idea why this? Where can I ...
1
vote
0answers
94 views

Windows 7 not staying in audit mode after reset

I am creating a custom image for WDS distribution and I'm having some difficulty, I can boot the reference machine into audit mode during the oobe phase with Ctrl+Shift+F3, but when I reset it (for ...
0
votes
0answers
204 views

Windows Audit Mode -cannot login

I am using this link to build a standard image of Windows 7: http://technet.microsoft.com/en-us/library/ee523217%28v=ws.10%29.aspx I got to the Windows Audit Mode point. For some odd reason, when my ...
0
votes
0answers
458 views

Get delete events with file name and user for particular folder

In my windows server 2012 i want to know which files is deleted from a folder by which network user. I want to track delete events only for particular folder. I have done it using group policy and ...
0
votes
1answer
2k views

Windows 7 Security Auditing being turned off - By what?

This has been driving me nuts. I've searched high and low for a solution but have found nothing. I did find this question which I thought held the solution through auditpol.exe. No dice. I can set my ...
1
vote
1answer
4k views

Bully for WPS wireless auditing: is it possible to continue an interrupted --bruteforce PIN test?

Bully is a neat program for wireless auditing: it allows to test WPS PINs against my router or access point so I can know if it is secure enough. Example: $ sudo bully mon0 --bssid 11:22:33:44:55:66 ...
1
vote
2answers
209 views

Linux server configuration audit tool

Is there any tool that validates and checks server configuration? I need something to audit my boxes - if they are well configured and connected to our monitoring (nagios now). Thanks for any ...
0
votes
0answers
166 views

Windows 7 Drive Letter Changed on Data Drive and Can't Log In

I just purchased an SSD for my computer to install the Windows OS files and my program files on, and for my other hard drive for my user directory. I got it all working through an answer file in audit ...
-1
votes
1answer
591 views

Cannot exit audit mode after upgrade to Windows 8

I accidentally entered audit mode from OOBE after upgrading to Windows 8, and now i get this message: . How do i get my system back to usable state?
1
vote
1answer
33 views

Making application visible to software audit tools

I'm writing a software for Windows which is not always installed via msi installer. The software is aimed for business customers. Bigger companies use tools to audit software installed on employee ...
-1
votes
1answer
53 views

Windows File Server audit

I would like to know that how to check out the logs of files and folders deletion on windows server 2008 as well as who did it from where and when?
3
votes
2answers
6k views

Find when password was changed - Windows SBS 2011

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect... I did NOT change this password and I had to ...
1
vote
1answer
661 views

Audit tab in advanced security setting of printer does not appear in Windows 7

I want to audit printer access failures on Windows 7. But when I go to printer properties->security->advanced, there is not Audit tab there. If I try to audit folder, Audit tab is there, but for ...
2
votes
2answers
1k views

Auditd - auditctl rule to monitor dir only (not all sub dir and files etc..)

I am trying to use auditd to monitor changes to a directory. The problem is that when I setup a rule, it monitors the directory I specified, but also all the subdirectories and files underneath it, ...
1
vote
0answers
160 views

Is auditing possible on Windows XP Home Edition?

Although Windows XP Professional has (a lot more) control over Security issues, Windows XP Home Edition does allow the regular user to probe around and allows to set Security settings on folders and ...
1
vote
3answers
2k views

Determine if product key is used on multiple computers

I'm the sole programmer at company. Not only that, I'm the sole person who's remotely computer literate above the "I can check my email". As such, I've been asked to go to all the machines, and ...
3
votes
1answer
104 views

keeping all versions of a directory

I am looking for a tool that can give me a timeline of all changes that where applied to the files in a given directory, together with the contents of all files at any given point. This cannot be ...
4
votes
2answers
474 views

Is there any file check summing software which deals correctly with deep paths?

I have been looking for software which will checksum and verify/compare NTFS volumes with deep paths on Windows, and failing verification on every one I've tried. I've even tried writing my own python ...
0
votes
1answer
195 views

Linux network audit

I have a server with Linux Red-hat Enterprise Edition 5.4 installed. and a client/server application that permits connection at the port 6000, but it doesn't offer connections log. I want to know ...
8
votes
2answers
4k views

File Auditing in Windows

I believe there is no other way to check on a Windows System (for instance Win 7) who has copied or access a file or folder except for enabling File Auditing in the Local Security Policy. Now that ...
0
votes
1answer
457 views

SQL Server: Audit permission denied

Is there any easy way to see those events in SQL Server 2008 for which permission was denied on a query (along with the text of the query and the specific object that permission was denied to)? I ...
2
votes
2answers
4k views

Does Intel centrino advanced-n wifi 6205 support packet injection? (For penetration testing)

Like it says does intel centrino advanced-n wifi 6205 support packet injection? I am a pen tester its not for unauthorized hacking....
1
vote
1answer
71 views

How to find my network and database access [closed]

Our company gets audited pretty regularly and I was wondering if there's an easy way to find out which accounts have access to what on our network? We're an all windows development shop, so all our ...
0
votes
1answer
525 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
1
vote
1answer
107 views

Scheduled Personal Software Audit / Inventory

Im trying to be very pro-active with getting a good backup now as my entire digital life as it were is on my laptop inc music etc. I currently take a USB drive backup and an online backup, however i ...
0
votes
1answer
11k views

How to set CommView to capture a specific wifi instead of the whole channel?

I am trying to experiment with CommView for Wifi. When I start searching for devices their are separated in channels. I click on the one I want and then Capture. As I see the program is capturing the ...
4
votes
2answers
6k views

How do I check if a user connected an external hard drive?

I originally came across this from a Citadel LLC complaint against a former employee. Text of complaint: http://www.scribd.com/doc/63606232/Citadel-vs-Yihao-Ben-Pu From the filing: "Forensic ...
0
votes
2answers
96 views

Windows Network resource access audit

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files) Is there a simple way to have such operations logged?