[THIN] Re: Logging which user shut server down
- From: "Robert K Coffman Jr - Info From Data Corporation" <bcoffman@xxxxxxxxxxxxxxxx>
- To: <thin@xxxxxxxxxxxxx>
- Date: Mon, 28 Mar 2005 09:30:35 -0500
MessageThis is a long shot, but verify that your system doesn't allow
shutdown without logging in. I had this happen on a server once, took a
while for me to figure out what was happening.
-----Original Message-----
From: thin-bounce@xxxxxxxxxxxxx [mailto:thin-bounce@xxxxxxxxxxxxx]On
Behalf Of Callahan, Michael
Sent: Saturday, March 26, 2005 9:20 AM
To: thin@xxxxxxxxxxxxx
Subject: [THIN] Re: Logging which user shut server down
You can on 2003, but not on 2000. Only way on 2000 that I'm aware of is
to audit privilege access and correlate that to the time that services like
event viewer were shut down prior to reboot. Joe's suggestion is a good
one, and one that you can implement in group policy. I do this in my
environment, and it has drastically cut down on the number of inadvertent
reboots.
If you can, you should work on a comprehensive role based access policy
that drastically reduces the number of people who have admin access. My
problems went away after I did this. As a wise man on the Exchange list once
said, there are seldom good technical solutions to behavioral problems.
Michael
Other related posts:
