审核用户适当的工作分配更改

文章翻译 文章翻译
文章编号: 163905 - 查看本文应用于的产品
本文已归档。它按“原样”提供,并且不再更新。
展开全部 | 关闭全部

概要

添加或从用户权限中删除用户或组时,Windows NT 可以审核。要审核这些类型的操作,请选择审核类别在用户管理器策略菜单下的安全策略更改审核。 这是唯一需要的审核类别,要审核这些特定的操作。 只有在文件中的审核类别和对象访问将添加额外的安全事件,但这些事件只是显示正在打开的对象和句柄被关闭的用户帐户访问填充添加用户和组对话框。

更多信息

下面是示例输出从安全事件日志时将用户添加到每个用户权利。虽然用户管理器无法区分用户权限和权限,实际上只权限是当前审核。不被审核的操作包括实际"权限。
  1. 从网络访问这台计算机: 任何事件
  2. 充当操作系统的一部分: (高级右)
    2/17/97  2:29:19 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeTcbPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  3. 将工作站添加到域:
    2/17/97  2:18:11 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeMachineAccountPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  4. 备份文件和目录,请执行以下操作:
    2/17/97  2:19:03 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeBackupPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  5. 跳过遍历检查: (高级右)
    2/17/97  2:30:06 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeChangeNotifyPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  6. 更改系统时间,请执行下列操作:
    2/17/97  2:19:57 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeSystemtimePrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  7. 创建页面文件: (高级右)
    2/17/97  2:30:57 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeCreatePagefilePrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  8. 创建记号对象: (高级右)
    2/17/97  2:31:45 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeCreateTokenPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  9. 创建永久共享的对象: (高级右)
    2/17/97  2:32:40 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeCreatePermanentPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  10. 调试程序: (高级右)
    2/17/97  2:33:41 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeDebugPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  11. 从远程系统强制关机,请执行以下操作:
    2/17/97  2:20:46 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeRemoteShutdownPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  12. 生成安全审核: (高级右)
    2/17/97  2:34:31 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeAuditPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  13. 增加配额: (高级右)
    2/17/97  2:35:12 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeIncreaseQuotaPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  14. 增加计划优先级: (高级右)
    2/17/97  2:35:52 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeIncreaseBasePriorityPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  15. 加载和卸载设备驱动程序:
    2/17/97  2:21:43 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeLoadDriverPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  16. 在内存中锁定页: (高级右)
    2/17/97  2:36:57 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeLockMemoryPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  17. 作为批处理作业登录: (高级右) 没有事件
  18. 作为服务登录: (高级右) 没有事件
  19. 在本地登录: 任何事件
  20. 管理审核和安全日志:
    2/17/97  2:25:18 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeSecurityPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  21. 修改固件环境值: (高级右)
    2/17/97  2:41:54 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeSystemEnvironmentPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  22. 分析单个进程: (高级右)
    2/17/97  3:20:18 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeProfileSingleProcessPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  23. 分析系统的性能: (高级右)
    2/17/97  3:21:11 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeSystemProfilePrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  24. 替换进程级令牌: (高级右)
    2/17/97  3:21:57 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeAssignPrimaryTokenPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  25. 还原文件和目录:
    2/17/97  2:26:13 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeRestorePrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  26. 关闭系统:
    2/17/97  2:27:00 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeShutdownPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
    Logon ID:   (0x0,0x1EDC)
    						
  27. 取得文件或其他对象的所有权:
    2/17/97  2:27:41 PM  Security Success Audit  Policy Change  608
    randymc  RANDYMC1 User Right Assigned:
    User Right: SeTakeOwnershipPrivilege
    Assigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944
    Assigned By:
    User Name:  randymc
    Domain:     RANDYMCD
       Logon ID:   (0x0,0x1EDC)
    						

属性

文章编号: 163905 - 最后修改: 2014年2月22日 - 修订: 2.1
这篇文章中的信息适用于:
  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0 开发员版
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
关键字:?
kbnosurvey kbarchive kbmt kbenv kbinfo KB163905 KbMtzh
机器翻译
注意:这篇文章是由无人工介入的微软自动的机器翻译软件翻译完成。微软很高兴能同时提供给您由人工翻译的和由机器翻译的文章, 以使您能使用您的语言访问所有的知识库文章。然而由机器翻译的文章并不总是完美的。它可能存在词汇,语法或文法的问题,就像是一个外国人在说中文时总是可能犯这样的错误。虽然我们经常升级机器翻译软件以提高翻译质量,但是我们不保证机器翻译的正确度,也不对由于内容的误译或者客户对它的错误使用所引起的任何直接的, 或间接的可能的问题负责。
点击这里察看该文章的英文版: 163905
Microsoft和/或其各供应商对于为任何目的而在本服务器上发布的文件及有关图形所含信息的适用性,不作任何声明。 所有该等文件及有关图形均"依样"提供,而不带任何性质的保证。Microsoft和/或其各供应商特此声明,对所有与该等信息有关的保证和条件不负任何责任,该等保证和条件包括关于适销性、符合特定用途、所有权和非侵权的所有默示保证和条件。在任何情况下,在由于使用或运行本服务器上的信息所引起的或与该等使用或运行有关的诉讼中,Microsoft和/或其各供应商就因丧失使用、数据或利润所导致的任何特别的、间接的、衍生性的损害或任何因使用而丧失所导致的之损害、数据或利润不负任何责任。

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com