Ethical Hacking Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package. | Computer Forensics Training at InfoSec Institute Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors. |

| Subject: | RE: [ISSForum] Logging of SP console access |
|---|---|
| Date: | Thu, 18 Nov 2004 10:58:01 -0600 |
Is there other means of tracing SP console access? In my environment (and to my preference) I don't have access to the SQL db. Is there a mechanism through the Console to run a report on this, or some external utility that would provide this information? danw -----Original Message----- From: issforum-bounces@iss.net [mailto:issforum-bounces@iss.net] On Behalf Of Sergey V Soldatov Sent: Wednesday, November 17, 2004 9:37 AM To: kfreese@kpmg.com Cc: issforum-bounces@iss.net; issforum@atla-mm1.iss.net Subject: RE: [ISSForum] Logging of SP console access You can get to know who had accessed SP through console. Try this. SELECT ADT.AuditTrailID, ADT.AuditTime, ADT.Username, ADC.EventDesc, ADI.ParamName, ADI.ParamValue from AuditTrail as ADT JOIN AuditInfo as ADI on ADT.AuditTrailID = ADI.AuditTrailID JOIN AuditEventCMD as ADC on ADT.AuditEventCMDID = ADC.AuditEventCMDID -- AuditEventCMDID 5 = console login, 6 = console logout WHERE ADT.AuditEventCMDID IN (5, 6) Hope it's what you need. Good luck! --- Best regards, Sergey V. Soldatov. Information security department. "Ballerini, Jean Paul (ISS EMEA)" To: "Freese, Kai" <kfreese@kpmg.com>, <JPBallerini@iss.net> "issforum@atla-mm1.iss.net" <issforum@iss.net> Sent by: cc: issforum-bounces@iss.net Subject: RE: [ISSForum] Logging of SP console access 17.11.2004 11:05 Kai, This is coming with SP5. Jean Paul -----Original Message----- From: issforum-bounces@atla-mm1.iss.net On Behalf Of Freese, Kai Sent: Monday, November 15, 2004 4:15 PM To: issforum@atla-mm1.iss.net Subject: [ISSForum] Logging of SP console access Hi all, does anybody know, is anywhere a log where I can find informations about who has accessed the SP console? Thanks in advance Kai -- Die Information in dieser eMail ist vertraulich und kann dem Berufsgeheimnis unterliegen. Sie ist ausschliesslich fuer den Adressaten bestimmt. Jeglicher Zugriff auf diese eMail durch andere Personen als den Adressaten ist untersagt. Sollten Sie nicht der fuer diese eMail bestimmte Adressat sein, ist Ihnen jede Veroeffentlichung, Vervielfaeltigung oder Weitergabe wie auch das Ergreifen oder Unterlassen von Massnahmen im Vertrauen auf erlangte Information untersagt. In dieser eMail enthaltene Meinungen oder Empfehlungen unterliegen den Bedingungen des jeweiligen Mandatsverhaeltnisses mit dem Adressaten. The information in this email is confidential and may be legally privileged. It is intended solely for the addressee. Access to this email by anyone else is unauthorized. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Any opinions or advice contained in this email are subject to the terms and conditions expressed in the governing KPMG client engagement letter. _______________________________________________ ISSForum mailing list ISSForum@iss.net TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to mod-issforum@iss.net The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list ISSForum@iss.net TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to mod-issforum@iss.net The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list ISSForum@iss.net TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to mod-issforum@iss.net The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328. _______________________________________________ ISSForum mailing list ISSForum@iss.net TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum To contact the ISSForum Moderator, send email to mod-issforum@iss.net The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
| <Prev in Thread] | Current Thread | [Next in Thread> |
|---|---|---|
| ||
| Previous by Date: | Re: [ISSForum] Site Protector Database structure, Sergey V Soldatov |
|---|---|
| Next by Date: | RE: [ISSForum] Reducing the number of events, vanskee2 mamen |
| Previous by Thread: | Re: [ISSForum] Logging of SP console access, Marcelo Barcelos Ferreira |
| Next by Thread: | RE: [ISSForum] Logging of SP console access, Sergey V Soldatov |
| Indexes: | [Date] [Thread] [Top] [All Lists] |