NT Auditing

Keywords: 	  NT Auditing wntAudit

---

Question:

Is there a way to directly enable NT auditing - I want to avoid:

;--------------------------------------------
; Select policy auditing in User Manager
;--------------------------------------------
Run("d:\winnt\system32\musrmgr.exe", "")
WinWaitExist("~User Manager", 10)
SendKey("!pd")

;--------------------------------------------
; Select Policy's
;--------------------------------------------
WinWaitExist("~Audit Policy", 20)
ErrorMode(@OFF)
WinINSTALL_handle=DllHwnd("Audit Policy")
AuditTheseEvents=cWndByID(WinINSTALL_handle,3402)
cRadioButton(AuditTheseEvents, 1)

; Logon and Logoff
LogonSuccess=cWndByID(WinINSTALL_handle,3412)
cCheckbox(LogonSuccess, 1)
LogonFailure=cWndByID(WinINSTALL_handle,3419)
cCheckbox(LogonFailure, 1)

;User and Group Management
UserManSucc=cWndByID(WinINSTALL_handle,3415)
cCheckbox(UserManSucc, 1)
UserManFaile=cWndByID(WinINSTALL_handle,3422)
cCheckbox(UserManFaile, 1)

; Security Policy Changes
SecuritySuccess=cWndByID(WinINSTALL_handle,3416)
cCheckbox(SecuritySuccess, 1)
SecurityFaile=cWndByID(WinINSTALL_handle,3423)
cCheckbox(SecurityFaile, 1)

OKButton=cWndByID(WinINSTALL_handle,1)
cPostButton(OKButton)
ErrorMode(@CANCEL)
WinClose("~User Manager")

Answer:

In current versions of the NT network extender are various flavors of wntAuditXXX functions that may do what you need.

Also you might look into Auditpol, located on the NT Server Resource Kit, e.g.:

runhidewait("d:\temp\Auditpol.exe", " /enable /logon:all /policy:all /sam:all")

---

Article ID:   W14389

Filename:   NT Auditing.txt