Securty Audit Correlating

Hi all,

Currently we are outsourcing our account creation,
password unlock/modify, folder creation/access control
and Internet/Applications Access Control to a third 
company and we need some audit and reports. We use AD
running on W2K Server.

Basically what we want to do is to activate GPO
Account Management and Object Access and create some
users with Admin/Account Operators rights and log
their object access on File Servers top folders and
account management tasks.

After that,we need to do some correlating with Help
Desk Tickets, based on time. We will audit that with
samples, not all logs or tickets.

The target is to discover if these accounts were used
without a help desk ticket, or they were used more
than they should be, based on the ticket.

My idea is to export both (event viewer and help desk
tickets) to a .txt, .cvs, etc file and compare them.
After that generate a report. I'd like to make some
automation for that...

Is there any best practices, samples, papers for that.

Any input or experience regarding it will be
appreciated.

Best Regards,

Jose Luiz


        
        
                
_______________________________________________________ 
Yahoo! Mail - Agora com 250MB de espaço gratuito. Abra 
uma conta agora! http://br.info.mail.yahoo.com/

---------------------------------------------------------------------------
---------------------------------------------------------------------------