Auditing not working properly

Home Forums Server Operating Systems Windows Server 2008 / 2008 R2 Auditing not working properly

Viewing 1 post (of 1 total)
  • Author
    Posts
  • Avatar
    Surduf
    Member
    #155033

    OK here goes I have a client that caught an administrator(there is more than one) making changes to files and directories and user accounts but said he had done nothing. We had logs of him making the changes and put him on probation. The admin then changed something in auditing or events so that when you add or delete a user you only get that the user was modified or deleted and it says system did it instead of the person actually doing the modifications.

    I know it is not much to go on. The domain is 2008 r2 and in 2008 mode. Any ideas would be greatly appreciated.

Viewing 1 post (of 1 total)

You must be logged in to reply to this topic.