How
can I check my machine's Security event logs? |
GFI Software has launched a free service on the Web, EventLogScan,
that uses an ActiveX control to scan your security event
logs online, group them by severity, and warn of any problems.
Full instructions as well as details about which audit settings
you need to enable are available at http://www.gfi.com/eventlogscan
. Because the tool uses ActiveX, Microsoft Internet Explorer
(IE) will ask you to execute a GFI ActiveX component. Details
about the scan service from GFI's press release are as follows:
"EventLogScan is an immediate online service that analyzes
all the events in the user's security event log and produces
an HTML report listing all the critical, high and medium
security events found on the user's machine, with a brief
explanation of each. This way, users can automatically see
how secure their system is without having to manually sort
through the many security events generated by their machine
each day - an activity that users usually do not have enough
time for or do not know how to perform, due to the event
log's cryptic/non-existent security event explanations and
because of "noise" events that make up a large ratio of
all security events."
How
can I collect all security event logs into one database? |
Windows 2000 and Windows NT don't provide a way to collect
security event logs from individual machines into a central
repository. However, several third-party products do.
GFI's LANguard
Security Event Log Monitor and TNT Software's ELM
Log Manager 3.0 are two such products.
How
can I enable advanced file-system and sharing security
for a Windows XP machine in a workgroup? |
When an XP machine belongs to a domain with shared resources,
a Security tab appears on the Properties dialog box for
the file, folder, or share. You can use this tab to assign
advanced sharing permissions. However, this tab is missing
for XP machines that belong to a workgroup.
A new feature in XP effectively logs all remote logons
in a workgroup as Guest, regardless of the account and
password credentials that the remote computer passes.
(This approach avoids the need for different machines
in a workgroup to replicate local accounts, which is the
method Windows 2000 uses to enable transparent sharing.)
XP locks down the Everyone group (of which Guest belongs)
permissions, which cuts down on the security problems
that existed in Win2K as a result of enabling the Guest
account. Because all machines in a workgroup are effectively
Guest connections, the advanced security features aren't
very useful, which is why Microsoft disabled them in XP.
If you want to enable advanced file-system and sharing
security, you must disable the ForceGuest registry setting
by performing the following steps:
- Start a registry editor (e.g., regedit.exe).
- Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\
CurrentControlSet\Control\Lsa registry subkey.
- Double-click forceguest, set it to 0, then click OK.
- Restart the computer for the change to take effect.
If you disable the Guest account but enable the ForceGuest
setting, remote connections will fail, regardless of what
username and password the user passes in--even if these
credentials are valid.
