To audit stuff in Windows Server you first need to configure a main event category to be enabled for ''Successes'' and/or ''Failures''. This must be done through a local GPO on the server or through a GPO in AD which then is linked to an OU containing the servers that should inherit those settings. Which main event category is needed depends on ...

You probably already know it by now. If you don't, where the heck have you been lately? Windows Server 2008 provides two installation options. The first is Windows Server WITH a GUI (Full Server) and the second one is Windows Server WITHOUT a GUI (Server Core). Although it only shows a command prompt after logon, it supports very limited GUI ...

You probably know similar output like: [RFSRWDC1] C:\>SC SDSHOW NTDS D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLORC;;;BO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)   But, what the heck does it mean? SDDL parsing tool to the rescue! [RFSRWDC1] C:\>SDDLPARSE ...

Microsoft has released the Remote Server Administration Tools (RSAT) for Windows Vista. Remember, to be able to install RSAT on Windows Vista, Service Pack 1 for Windows Vista is required and must therefore already be installed! Download locations can be found below: Microsoft Remote Server Administration Tools for Windows Vista SP1 ...

Have you ever had the need to audit when members of specific groups logon to a computer? If yes, unfortunately this is only possible out-of-the-box in both Windows Vista and Windows Server 2008. The feature is called ''Auditing Special Groups'' and you can configure it through the GPMC in Windows Server 2008 and hopelly soon in Windows Vista SP1 ...

Always interested to know which security auditing event IDs exist for Windows Vista and Windows Server 2008? Well, get it here then!   Cheers, Jorge -------------------------------------------------------------------------------------------------- * This posting is provided ''AS IS'' with no warranties and confers no rights! * ...

This post is an updated version of the following post and now contains RTM information: Windows Server Longhorn – Reanimating Objects and Restoring Additional Information   Reanimating Objects and Restoring Additional Information Basically when restoring deleted objects you have two choices. You either authoritatively restore the ...

In addition to a previous post a did, I would like to point you to a Microsoft blog about the Windows Time Service (W32TIME). That blog contains interesting information. My favorite posts on that blog are: Keeping the Domain On Time (Explaining how Windows Time Service works in an AD forest) Configuring the Time Service: NtpServer and ...

Delegating permissions to manage services on servers is not the easiest thing to do. You can do it from the command line or through a GPO in the ''System Services'' node. Either way you MUST take the current configured permissions into account, otherwise you might/will experience issues! I do not like to use a GPO to do this and prefer to use ...

The beta periods for both Windows Vista SP1 and Windows Server 2008 have closed. Both products are final and have actually RTMed as of today! More information about the RTM can be read ...