The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
8 views

Automate removal of Audit Policy settings

I have a large number of files in the System32 directory that have audit policy settings that were configured directly as well as other audit policy settings that were inherited. I need to remove all ...
5
votes
4answers
4k views

How to audit all the software installed on a PC [closed]

one of my customers is going to be audited by a Microsoft partner to check if all the installed software is legal. So far, so good with the software I installed: all the Windows XP machines have ...
1
vote
1answer
3k views

Does Intel centrino advanced-n wifi 6205 support packet injection? (For penetration testing)

Like it says does intel centrino advanced-n wifi 6205 support packet injection? I am a pen tester its not for unauthorized hacking....
-1
votes
1answer
39 views

Windows File Server audit

I would like to know that how to check out the logs of files and folders deletion on windows server 2008 as well as who did it from where and when?
3
votes
2answers
1k views

Find when password was changed - Windows SBS 2011

I'm finding my self at a lost cause, basically when attempting to access one of the servers I manage I was unable to login, the password was incorrect... I did NOT change this password and I had to ...
0
votes
0answers
220 views

Windows 7 Security Auditing being turned off - By what?

This has been driving me nuts. I've searched high and low for a solution but have found nothing. I did find this question which I thought held the solution through auditpol.exe. No dice. I can set my ...
1
vote
0answers
23 views

Windows 7 not staying in audit mode after reset

I am creating a custom image for WDS distribution and I'm having some difficulty, I can boot the reference machine into audit mode during the oobe phase with Ctrl+Shift+F3, but when I reset it (for ...
0
votes
0answers
13 views

Windows Audit Mode -cannot login

I am using this link to build a standard image of Windows 7: http://technet.microsoft.com/en-us/library/ee523217%28v=ws.10%29.aspx I got to the Windows Audit Mode point. For some odd reason, when my ...
0
votes
0answers
9 views

Multihop SSH connections not showing up in lastlog

We all know that adding the following to your .ssh/config file will allow seamless ssh hopping through a gateway host: Host *.internal.workdomain.com ProxyCommand ssh gateway.workdomain.com nc %h ...
0
votes
0answers
36 views

Get delete events with file name and user for particular folder

In my windows server 2012 i want to know which files is deleted from a folder by which network user. I want to track delete events only for particular folder. I have done it using group policy and ...
1
vote
1answer
166 views

Auditd - auditctl rule to monitor dir only (not all sub dir and files etc..)

I am trying to use auditd to monitor changes to a directory. The problem is that when I setup a rule, it monitors the directory I specified, but also all the subdirectories and files underneath it, ...
0
votes
1answer
520 views

Bully for WPS wireless auditing: is it possible to continue an interrupted --bruteforce PIN test?

Bully is a neat program for wireless auditing: it allows to test WPS PINs against my router or access point so I can know if it is secure enough. Example: $ sudo bully mon0 --bssid 11:22:33:44:55:66 ...
1
vote
2answers
51 views

Linux server configuration audit tool

Is there any tool that validates and checks server configuration? I need something to audit my boxes - if they are well configured and connected to our monitoring (nagios now). Thanks for any ...
0
votes
0answers
66 views

Windows 7 Drive Letter Changed on Data Drive and Can't Log In

I just purchased an SSD for my computer to install the Windows OS files and my program files on, and for my other hard drive for my user directory. I got it all working through an answer file in audit ...
0
votes
0answers
24 views

Meaning of type=BPRM_FCAPS in a ausearch

I and using Linux auditing. In my ausearch results I see entries with type=BPRM_FCAPS Can anyone tell me what they are?
-2
votes
1answer
108 views

Cannot exit audit mode after upgrade to Windows 8

I accidentally entered audit mode from OOBE after upgrading to Windows 8, and now i get this message: . How do i get my system back to usable state?
1
vote
1answer
28 views

Making application visible to software audit tools

I'm writing a software for Windows which is not always installed via msi installer. The software is aimed for business customers. Bigger companies use tools to audit software installed on employee ...
1
vote
1answer
256 views

Audit tab in advanced security setting of printer does not appear in Windows 7

I want to audit printer access failures on Windows 7. But when I go to printer properties->security->advanced, there is not Audit tab there. If I try to audit folder, Audit tab is there, but for ...
3
votes
2answers
235 views

Is there any file check summing software which deals correctly with deep paths?

I have been looking for software which will checksum and verify/compare NTFS volumes with deep paths on Windows, and failing verification on every one I've tried. I've even tried writing my own python ...
0
votes
0answers
102 views

Is auditing possible on Windows XP Home Edition?

Although Windows XP Professional has (a lot more) control over Security issues, Windows XP Home Edition does allow the regular user to probe around and allows to set Security settings on folders and ...
1
vote
1answer
195 views

How do I find out what my SQL Server database audit records contain?

I need to find out if my SQL Server 2005 database audit records contain the required information that I need. Where or how can I find this out?
1
vote
3answers
1k views

Determine if product key is used on multiple computers

I'm the sole programmer at company. Not only that, I'm the sole person who's remotely computer literate above the "I can check my email". As such, I've been asked to go to all the machines, and ...
3
votes
1answer
91 views

keeping all versions of a directory

I am looking for a tool that can give me a timeline of all changes that where applied to the files in a given directory, together with the contents of all files at any given point. This cannot be ...
0
votes
1answer
101 views

Linux network audit

I have a server with Linux Red-hat Enterprise Edition 5.4 installed. and a client/server application that permits connection at the port 6000, but it doesn't offer connections log. I want to know ...
8
votes
2answers
1k views

File Auditing in Windows

I believe there is no other way to check on a Windows System (for instance Win 7) who has copied or access a file or folder except for enabling File Auditing in the Local Security Policy. Now that ...
1
vote
1answer
67 views

How to find my network and database access [closed]

Our company gets audited pretty regularly and I was wondering if there's an easy way to find out which accounts have access to what on our network? We're an all windows development shop, so all our ...
0
votes
1answer
168 views

SQL Server: Audit permission denied

Is there any easy way to see those events in SQL Server 2008 for which permission was denied on a query (along with the text of the query and the specific object that permission was denied to)? I ...
0
votes
1answer
380 views

HDI: Capture specific content types in wireshark?

I've been tasked to audit in/outbound traffic at our site, but I don't know much about Wireshark. I understand how to set up a capture filter for broad protocols (IP only or tcp, udp, icmp, etc), but ...
3
votes
1answer
570 views

How do I audit CD/DVD tray opening events in Windows 7?

Since installing Windows 7, the entire office has experienced random CD tray openings, sometimes while we are in the office, sometimes not. On my PC, I have two disc-reading devices, but only the ...
1
vote
1answer
105 views

Scheduled Personal Software Audit / Inventory

Im trying to be very pro-active with getting a good backup now as my entire digital life as it were is on my laptop inc music etc. I currently take a USB drive backup and an online backup, however i ...
3
votes
4answers
2k views

Will Windows show a warning if someone tries to guess my password for a lot of times?

To access shared files on my Windonw 7 computer, another person can go through the wireless network and provide the correct user name and password and access those files. I heard a 802.11b or g ...
2
votes
1answer
2k views

Microsoft Office 2007 license self-audit?

I've been given the task of getting the company I work for into compliance. I currently have 71 users with Office 2007 installed: 35 users on key A 9 users on key B 27 users on key C Here is my ...
0
votes
1answer
6k views

How to set CommView to capture a specific wifi instead of the whole channel?

I am trying to experiment with CommView for Wifi. When I start searching for devices their are separated in channels. I click on the one I want and then Capture. As I see the program is capturing the ...
3
votes
2answers
3k views

How do I check if a user connected an external hard drive?

I originally came across this from a Citadel LLC complaint against a former employee. Text of complaint: http://www.scribd.com/doc/63606232/Citadel-vs-Yihao-Ben-Pu From the filing: "Forensic ...
0
votes
2answers
89 views

Windows Network resource access audit

In a windows network I'd like to set up some kind of audit, to know when certain users access certain resources (e.g. copy files) Is there a simple way to have such operations logged?
0
votes
1answer
168 views

Why are the properties for Audit Policy Disabled?

=I am logged in as an Administrator on my machine and when I check Local Security Settings -> Audit Policy -> Audit Account logon events I click on "Properties" and try to turn it off for "Success" ...
1
vote
0answers
43 views

Is there a dpkg -C program which actually checks if the files are present in the filesystem?

In other words, read the dpkg database to see if some of the files are missing. I accidentally the system with rm -rf and then quickly hit ^C when I realised what I was doing but I don't know what's ...
5
votes
1answer
1k views

Windows Security Log and Audit Failures

I was doing some routine maintenance on a Windows Server 2008 box that I manage. When looking at the Security Log in the Windows Event Log interface I see a burst of 50-200 failed logins that happen ...
1
vote
2answers
759 views

How do I find out when and by whom a particular user was deleted in linux?

I've recently ran into a very odd occurrence on one system I'm using. For no apparent reason, my user account was deleted, although the home directory is still there. I have root access, so I can ...
0
votes
2answers
236 views

To-do list and time-auditing software

Hey, I saw a couple other topics like this but i believe my requirements are a little different. NEED: I'm working on alot of odd jobs for several people and need to keep precise track of the time ...
2
votes
4answers
111 views

Windows Vista Ultimate Auditing

I am in a position where I might have to prove that I made a certain amount of MB downloads from the Internet including webpages browsed to a court of law. Is there a way of finding this out from ...
3
votes
7answers
891 views

How to tell if a laptop has been used of off the normal network

OK So here is the situation: We have a number of laptops in our organisation. A percentage of the users of these laptops, we beleive never take the laptops out of the building or even out of the ...