Guest inenewbl Posted August 12, 2008 Posted August 12, 2008 Hi all. I checked on the internet and the security log is supposed to generate event IDs 512 & 513 whenever there is windows 2003 startup or shutdown. I have enabled auditing of system events. However i still do not get events 512 & 513 logged in my security log whenever there is startup or shutdown. Pls advise how i can enable events 512 & 513 logged. Thks in advance.
Guest Ace Fekay [MVP Direcrtory Services] Posted August 12, 2008 Posted August 12, 2008 Re: event id 512,513 "inenewbl" <inenewbl@discussions.microsoft.com> wrote in message news:1299BD5F-E69C-45EB-A8F3-F4796C7E62D1@microsoft.com... > Hi all. I checked on the internet and the security log is supposed to > generate event IDs 512 & 513 whenever there is windows 2003 startup or > shutdown. I have enabled auditing of system events. However i still do not > get events 512 & 513 logged in my security log whenever there is startup > or > shutdown. Pls advise how i can enable events 512 & 513 logged. Thks in > advance. Do you have auditing enabled? Here are some articles to read about how to do it and what type of events to audit. Monitoring Important Security EventsIf Audit system events is enabled, Win2K logs event ID 512 (Windows NT is ... To detect unauthorized read attempts, enable auditing for failed Read data ... http://windowsitpro.com/Windows/Articles/ArticleID/40046/pg/2/2.html Auditing Security EventsHow to enable auditing for Active Directory objects. .... In the Category list, choose the event category. In the Event ID box, enter the event identity ... http://www.tech-faq.com/auditing-security-events.shtml Monitoring Important Security EventsIf Audit system events is enabled, Win2K logs event ID 512 (Windows NT is ... To detect unauthorized read attempts, enable auditing for failed Read data ... http://windowsitpro.com/Windows/Articles/ArticleID/40046/pg/2/2.html -- Regards, Ace This posting is provided "AS-IS" with no warranties or guarantees and confers no rights. Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP Microsoft MVP - Directory Services Microsoft Certified Trainer For urgent issues, you may want to contact Microsoft PSS directly. Please check http://support.microsoft.com for regional support phone numbers. Infinite Diversities in Infinite Combinations
Guest Meinolf Weber Posted August 12, 2008 Posted August 12, 2008 Re: event id 512,513 Hello inenewbl, If you talk about system/computer startup/shutdown you have to look for event id 6009 and 6005. Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights. ** Please do NOT email, only reply to Newsgroups ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm > Hi all. I checked on the internet and the security log is supposed to > generate event IDs 512 & 513 whenever there is windows 2003 startup or > shutdown. I have enabled auditing of system events. However i still do > not get events 512 & 513 logged in my security log whenever there is > startup or shutdown. Pls advise how i can enable events 512 & 513 > logged. Thks in advance. >
Recommended Posts