RE: Auditing a reboot

From: Brad Judy <judy(at)colorado.edu>
Date: Mon Apr 21 2003 - 10:29:54 EDT

There are several items that are logged on startup, some of which may also be logged at other times. Try the normal first item to be logged - an event 6009 that states the basic OS version information. See this KB article for more info -
http://support.microsoft.com/default.aspx?scid=kb;EN-US;196452

Note that this is an event that occurs on startup regardless of how the machine was shut down. Other events may be logged as discussed in the article above. If you want something more specific you may have to look elsewhere.

Brad Judy

Information Technology Services
University of Colorado at Boulder

> -----Original Message-----
> From: Hillensbeck, Preston [mailto:PHillensbeck@sfbcic.com]
> Sent: Monday, April 21, 2003 7:14 AM
> To: 'focus-ms@securityfocus.com'

---

Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-focus-ms

---

Received on Mon Apr 21 11:58:51 2003