First you will want the logs to auto archive:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application]
"MaxSize"=dword:06400000
"Retention"=dword:00278d00
"RestrictGuestAccess"="1"
"AutoBackupLogFiles"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security]
"MaxSize"=dword:06400000
"Retention"=dword:ffffffff
"RestrictGuestAccess"="1"
"AutoBackupLogFiles"=dword:00000001
"WarningLevel"=dword:0000005a
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System]
"MaxSize"=dword:06400000
"Retention"=dword:00278d00
"RestrictGuestAccess"="1"
"AutoBackupLogFiles"=dword:00000001
Then take a look at this for some methods of auditing your audits.
http://www.davekleiman.com/Files/HTCIACyberCrimeSummit_For_CD.zip
Dave
Respectfully,
______________________________________________________
Dave Kleiman, CAS,CCE,CIFI,CISM,CISSP,ISSAP,ISSMP,MCSE
http://www.davekleiman.com/about.php
-----Original Message-----
From: Davie Elliott - Eluse [mailto:delliott@eluse.co.uk]
Sent: Sunday, May 21, 2006 09:27 AM
To: security-basics@securityfocus.com
Subject: MS Audit logs
Hi everyone,
I'm a bit of a newbie administrator, and I have a quick
question about Microsoft windows audit logs.
Right now I have ticked every audit option in the main GPO,
so I get tons of audit objects to trawl through every week.
I was reading somewhere that MS Audit logs cycle or
something so after 24 hours I have lost some audit objects.
Also, I don't really know what I'm looking for in the audits
logs anyway...
except for maybe checking if some users accounts have been
used when they shouldn't have.
Anyways, I was wondering what software would be good for
managing the audit logs?... I think I read a blog from an MS
employee saying someone should use 3rd party software for
managing the audit logs instead of the built-in windows thing.
Thanks for your help,
Davie.
