|
Posted by GreggMB on October 22, 2006, 12:09 pm
Please log in for more thread options
P.S.:
I meant to say that I enabled FULL AUDIT (and not "AUDITION") on the server
- sorry, I'm kind of rushing with this...
"GreggMB" wrote:
> This is about remote access to Application and System logs (and not access to
> Security log that's managed through Policy).
>
> Operating System: Windows 2003 SP1
>
> PROBLEM:
> I need to have a USER (and not Administrator) to have access to Application
> & System logs. That user is "reviewing official" and must not be able to
> gain administrative access to the server.
> Important: no users are allowed to logon to the server at the console (not
> an option), users are allowed to access the server from the Network ONLY.
>
> Regardless of many efforts (policies, custom GPO for access to these logs =
> "CustomSD" if you know what I mean, Remote Registry access = "winreg"
> permissions, verification of DCOM which doesn't seem to have anything to do
> with this) I cannot get to the point where user could view the logs (Sys &
> App) from remote system.
>
> Another important note: server is "stand alone" and "matching credential" is
> used.
>
> CONSISTENT EFFECT:
> This user account has absolutely no problem connecting to the server from
> remote system (verified and validated). User has no problem viewing Security
> Log remotely (through Local Policy - "User Rihts" set on the server).
> Therefore "matching credential" is not an issue at all.
>
> ADDITIONAL OBSERVATION:
> 1. I analyzed IP pockets containing request to access System and Application
> log. To my surprise these packets (15 frames total) contains reference to
> "C$" ...
>
> 2. I've enabled FULL AUDITION (all options) and "perfected" this connection
> from remote system to the point that there is simply NO MORE FAILURES logged
> on the server. This is regardless of the fact that every time the user
> attempts to view App or Sys [remote] log he gets "Access denied"
> message/error.
>
> I'm looking for any input.
>
> Serious and very technical advice only please, this is not about "basics".
> It is possible that what I'm trying to achieve is simply blocked "by design"
> and that I won't be able to get this work (which would be sort of very
> disappointing as this introduces unnecessary risk).
>
> Thanks for your attention!
>
> Gregg M. B.
>
| 
XML Sitemap