稽核使用者權限指派變更

重要:本文是以 Microsoft 機器翻譯軟體翻譯而成,而非使用人工翻譯而成。Microsoft 同時提供使用者人工翻譯及機器翻譯兩個版本的文章,讓使用者可以依其使用語言使用知識庫中的所有文章。但是,機器翻譯的文章可能不盡完美。這些文章中也可能出現拼字、語意或文法上的錯誤,就像外國人在使用本國語言時可能發生的錯誤。Microsoft 不為內容的翻譯錯誤或客戶對該內容的使用所產生的任何錯誤或損害負責。Microsoft也同時將不斷地就機器翻譯軟體進行更新。

按一下這裡查看此文章的英文版本:163905
本文已封存。本文係以「現狀」提供且不會再更新。
結論
Windows NT 可以稽核使用者或群組會加入至或從使用者右移除時。若要稽核這些類型的動作,請選擇稽核分類安全性原則變更在 [使用者管理員原則] 功能表下的稽核。 這是唯一需要的稽核類別稽核這些特定的動作。 只有稽核類別目錄檔案及物件存取會新增額外的安全性事件,但是這些事件只會顯示物件正在開啟和關閉使用者帳戶存取控點,新增使用者及群組] 對話方塊方塊中填入。
其他相關資訊
下面是範例輸出安全性事件日誌,當使用者加入至每個使用者靠右。雖然使用者管理員並不區分使用者權限和權限,實際上只權限目前稽核。不稽核的動作都實際上 」 權利 」。
  1. 從網路存取這台電腦: 沒有事件
  2. 扮演作業系統的一部分: (進階靠右)
    2/17/97  2:29:19 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeTcbPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  3. 新增工作站到網域:
    2/17/97  2:18:11 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeMachineAccountPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  4. 備份檔案和目錄:
    2/17/97  2:19:03 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeBackupPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  5. 略過周遊檢查: (進階靠右)
    2/17/97  2:30:06 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeChangeNotifyPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  6. 變更系統時間:
    2/17/97  2:19:57 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeSystemtimePrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  7. 建立一個分頁檔: (進階靠右)
    2/17/97  2:30:57 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeCreatePagefilePrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  8. 建立權杖物件: (進階靠右)
    2/17/97  2:31:45 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeCreateTokenPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  9. 建立永久共用的物件: (進階靠右)
    2/17/97  2:32:40 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeCreatePermanentPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  10. 偵錯程式: (進階靠右)
    2/17/97  2:33:41 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeDebugPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  11. 從遠端系統強制關機:
    2/17/97  2:20:46 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeRemoteShutdownPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  12. 產生安全性稽核: (進階靠右)
    2/17/97  2:34:31 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeAuditPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  13. 增加配額: (進階靠右)
    2/17/97  2:35:12 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeIncreaseQuotaPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  14. 增加排程優先權: (進階靠右)
    2/17/97  2:35:52 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeIncreaseBasePriorityPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  15. 載入和卸載裝置驅動程式:
    2/17/97  2:21:43 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeLoadDriverPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  16. 鎖定記憶體中的頁面: (進階靠右)
    2/17/97  2:36:57 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeLockMemoryPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  17. 以批次工作登入: (進階靠右) 沒有事件
  18. 登入為一個服務: (進階靠右) 沒有事件
  19. 在本機上登入: 沒有事件
  20. 管理稽核及安全性記錄檔:
    2/17/97  2:25:18 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeSecurityPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  21. 修改韌體環境值: (進階靠右)
    2/17/97  2:41:54 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeSystemEnvironmentPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  22. 設定檔單一處理程序: (進階靠右)
    2/17/97  3:20:18 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeProfileSingleProcessPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  23. 設定檔系統效能: (進階靠右)
    2/17/97  3:21:11 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeSystemProfilePrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  24. 更換處理層權杖: (進階靠右)
    2/17/97  3:21:57 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeAssignPrimaryTokenPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  25. 還原檔案和目錄:
    2/17/97  2:26:13 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeRestorePrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  26. 將系統關機:
    2/17/97  2:27:00 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeShutdownPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCDLogon ID:   (0x0,0x1EDC)						
  27. 取得檔案或其他物件的擁有權:
    2/17/97  2:27:41 PM  Security Success Audit  Policy Change  608randymc  RANDYMC1 User Right Assigned:User Right: SeTakeOwnershipPrivilegeAssigned To:   S-1-5-21-2092848103-1120294241-1737835142-7944Assigned By:User Name:  randymcDomain:     RANDYMCD   Logon ID:   (0x0,0x1EDC)						

警告:本文為自動翻譯

內容

文章識別碼:163905 - 最後檢閱時間:02/22/2014 06:47:36 - 修訂: 2.1

Microsoft Windows NT Workstation 3.5, Microsoft Windows NT Workstation 3.51, Microsoft Windows NT Workstation 4.0 Developer Edition, Microsoft Windows NT Server 3.51, Microsoft Windows NT Server 4.0 Standard Edition

  • kbnosurvey kbarchive kbmt kbenv kbinfo KB163905 KbMtzh
意見反應