RE: [ISSForum] Logon_with_admin_privileges with no user name

["Bahaa Hudairi" <[EMAIL PROTECTED]>]

Hi ,

 

We have faced this issue and had thousands of events being logged daily. This is because the server sensor enables auditing on the server and gets its events from the event log. One other thing is that it's not possible to separate internal system access with admin privilege with network access with admin privilege, that’s why at the end you get lots of events.

 

ISS recommended removing this check so as to get rid of this event.

 

Regards,

 

Bahaa Hudairi

Technical Consultant

Elite Computer Solutions

P.O. Box: 58915

Riyadh, 11515

Kingdom of Saudi Arabia

http://www.elite.com.sa

 

Tel.: + (966 1) 472 5240 ext 56

Fax: + (966 1) 472 5245

Mobile: +966 (0)5 622 1897

 

-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Mohr James
Sent: Wednesday, February 18, 2004 2:30 PM
To: [EMAIL PROTECTED]
Subject: [ISSForum] Logon_with_admin_privileges with no user name

 

Hi All!

 

We have a Windows 2000 machine with server sensor 7. We are regularly

getting Logon_with_admin_privileges events in which the User Name is

blank. Is this normal? Is there any way of determining which user it is?

Any help is appreaciated.

 

Regards,

 

Jim Mohr

 

_______________________________________________

ISSForum mailing list

[EMAIL PROTECTED]

 

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo