event id 512,513

Discussion in 'Windows Server' started by inenewbl, Aug 12, 2008.

  1. inenewbl

    inenewbl Guest

    Hi all. I checked on the internet and the security log is supposed to
    generate event IDs 512 & 513 whenever there is windows 2003 startup or
    shutdown. I have enabled auditing of system events. However i still do not
    get events 512 & 513 logged in my security log whenever there is startup or
    shutdown. Pls advise how i can enable events 512 & 513 logged. Thks in
    advance.
     
    inenewbl, Aug 12, 2008
    #1
    1. Advertisements

  2. Do you have auditing enabled? Here are some articles to read about how to do
    it and what type of events to audit.

    Monitoring Important Security EventsIf Audit system events is enabled, Win2K
    logs event ID 512 (Windows NT is ... To detect unauthorized read attempts,
    enable auditing for failed Read data ...
    http://windowsitpro.com/Windows/Articles/ArticleID/40046/pg/2/2.html

    Auditing Security EventsHow to enable auditing for Active Directory objects.
    .... In the Category list, choose the event category. In the Event ID box,
    enter the event identity ...
    http://www.tech-faq.com/auditing-security-events.shtml

    Monitoring Important Security EventsIf Audit system events is enabled, Win2K
    logs event ID 512 (Windows NT is ... To detect unauthorized read attempts,
    enable auditing for failed Read data ...
    http://windowsitpro.com/Windows/Articles/ArticleID/40046/pg/2/2.html


    --
    Regards,
    Ace

    This posting is provided "AS-IS" with no warranties or guarantees and
    confers no rights.

    Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
    MVP Microsoft MVP - Directory Services
    Microsoft Certified Trainer

    For urgent issues, you may want to contact Microsoft PSS directly. Please
    check http://support.microsoft.com for regional support phone numbers.

    Infinite Diversities in Infinite Combinations
     
    Ace Fekay [MVP Direcrtory Services], Aug 12, 2008
    #2
    1. Advertisements

  3. Hello inenewbl,

    If you talk about system/computer startup/shutdown you have to look for event
    id 6009 and 6005.

    Best regards

    Meinolf Weber
     
    Meinolf Weber, Aug 12, 2008
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.