Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2003
    - Admin Tips
      - Security
        Protect Your Security Logs

Section(s): Admin , Security
Published on Jul 26, 2005.
Last Modified on Jul 26, 2005.
Last Modified by Mitch Tulloch.
Rated 1.4 out of 5 based on 5 votes.

Tip on how to protect your Security logs.

What's the best way to protect your servers against a rogue admin using a tool like Winzapper to cover their tracks? Regularly archive the Security logs on all your servers to a secure location that only you have access to. You might try robocopy.exe and schtasks.exe as a simple solution for this, or you can use one of the integrated log monitors available from third-party vendors, or you can wait for Microsoft's Audit Collection Services (ACS) to be released soon.

About Mitch Tulloch

Mitch Tulloch was lead author for the Windows Vista Resource Kit from Microsoft Press, which is the book for IT pros who want to deploy, maintain and support Windows Vista in mid- and large-sized network environments. Mitch was also the author of Introducing Windows Server 2008 and technical project lead for the Microsoft Office Communications Server 2007 Resource Kit, both books also from Microsoft Press. For more information on these and other books by Mitch, see www.mtit.com .