RE: Auditing a reboot

From: Hillensbeck, Preston <PHillensbeck(at)sfbcic.com>
Date: Mon Apr 21 2003 - 10:33:45 EDT

I guess I should have been more specific! What I am trying to audit is an event that says who or what rebooted the machine. I see the normal 6005 and 6009 event messages, but I would really like to know who initiated the reboot. Is this possible?

-----Original Message-----
From: Brad Judy [mailto:judy@colorado.edu] Sent: Monday, April 21, 2003 9:30 AM
To: 'Hillensbeck, Preston'; focus-ms@securityfocus.com Subject: RE: Auditing a reboot

There are several items that are logged on startup, some of which may also be logged at other times. Try the normal first item to be logged - an event 6009 that states the basic OS version information. See this KB article for more info -
http://support.microsoft.com/default.aspx?scid=kb;EN-US;196452

Note that this is an event that occurs on startup regardless of how the machine was shut down. Other events may be logged as discussed in the article above. If you want something more specific you may have to look elsewhere.

Brad Judy

Information Technology Services
University of Colorado at Boulder

> -----Original Message-----

---

Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-focus-ms

---

Received on Mon Apr 21 12:00:41 2003