## Security Auditing

The syslog utility audits security-related events on UNIX. The level of logging and location for logging information is normally customized using a configuration file. By default, security logging is turned off on Windows NT. To turn on security logging, run User Manager for Domains so you can enable auditing and determine what events to track. Events are viewed through the Event Viewer program.

The Security Log (Systemroot\System32\Config\Secevent.evt) contains both valid and invalid logon attempts as well as events related to resource use including creating, opening, or deleting files or other objects. For example, if you use User Manager for Domains to enable logon and logoff auditing, attempts to log on and log off the system are recorded in the Security Log. Multiple logon failures could be an indication that someone is trying to break into the system.

©1997 Microsoft Corporation. All rights reserved. Legal Notices.
Last Updated: December 1, 1997