full-disclosure - Windows 2000 Logout events are not monitored!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: DARREN.L.BENNETT at saic.com (Darren Bennett)
Subject: Windows 2000 Logout events are not monitored!

Bill,

	In windows 2k pro it is even 538. Are you talking about win 2k server
only? In either case, logout events in win2k pro are broken. If anyone
has a fix, I'd be happy to hear about it.

	-Darren

On Mon, 2003-11-10 at 16:44, Bill Royds wrote:
> The logout even is event number 540 in security log. All the Win2K I manage
> have these entries for every logout. Check your security policy to ensure
> that you are recording them.
> There are in Local Security Policy MMS under Local Policies/Audit
> Events/{Audit account logon events,Audit logon events}. YOu want both
> success and failure to caputre a successful logoff.
> 
> ----- Original Message ----- 
> From: "Darren Bennett" <DARREN.L.BENNETT@...c.com>
> To: "Full Disclosure" <full-disclosure@...ts.netsys.com>
> Sent: Monday, November 10, 2003 12:42 PM
> Subject: [Full-Disclosure] Windows 2000 Logout events are not monitored!
> 
> 
> : It's possible this has been on the list before but I'm going to check
> : anyway. With windows 2000 (server is the platform I have tested), when
> : auditing of login/logout events is enabled, only login events are
> : recorded. This appears to be a bug with Windows. I have tried applying a
> : patch from Microsoft that is supposed to fix this and the patch didn't
> : work. Anyone else seen this behavior? Any suggestions on how I could
> : record logout events without relying on MS?
> :
> : -Thanks,
> :
> : Darren
> :
> :
> : -----------------------------------------------
> : Darren Bennett - CISSP
> : Sr. Systems Administrator/Manager
> : Science Applications International Corporation
> : Advanced Systems Development and Integration
> : -----------------------------------------------
> :
> : _______________________________________________
> : Full-Disclosure - We believe in it.
> : Charter: http://lists.netsys.com/full-disclosure-charter.html
-- 
-----------------------------------------------
Darren Bennett - CISSP
Sr. Systems Administrator/Manager
Science Applications International Corporation
Advanced Systems Development and Integration
-----------------------------------------------