User Account Permissions changed...

Posted: 12-03-2007, 09:33 PM

Jeremy Mitchell

Guest
Posts: n/a

I have searched the group and the web but havent found the specifics to where
I can find the answer to my question.

Where in Event viewer can I find what account was used to change a users
account group? The user was added to the local machine as an administrator.
I have searched Event Viewer but cannot find it in the logs. What is the
event ID for an account permission change?

Thanks for your help. Also, if this has been answered before, please post
the link.

Responses to "User Account Permissions changed..."

Ronnie Vernon MVP

Guest
Posts: n/a

Re: User Account Permissions changed...

Posted: 12-05-2007, 04:30 AM

Jeremy

I don't think changing a user account type is logged in the event viewer. It
would take an admin account to perform this type of action.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User

"Jeremy Mitchell" <JeremyMitchell@discussions.microsoft.com> wrote in
message news:1A4A358B-A1F5-4236-B1A7-5163F36CCEBF@microsoft.com...

>I have searched the group and the web but havent found the specifics to
>where
> I can find the answer to my question.
>
> Where in Event viewer can I find what account was used to change a users
> account group? The user was added to the local machine as an
> administrator.
> I have searched Event Viewer but cannot find it in the logs. What is the
> event ID for an account permission change?
>
> Thanks for your help. Also, if this has been answered before, please post
> the link.
>

Jeremy Mitchell

Guest
Posts: n/a

Re: User Account Permissions changed...

Posted: 12-05-2007, 01:59 PM

Ronnie,

Thanks for the response. After further investigation, if I am not mistaken,
I believe this event would only be logged if the "Audit account Management"
subcategory is enabled in the Local Security Policy on each PC, or the parent
Audit Policy was enabled, which would turn on all auditing events. The IT
person who elevated the user's permissions does have domain admin rights. I
just wanted to try and find concrete evidence.

From what I have read, when all auditing features are enabled, you should be
able to go back and find anything that was done on the pc. This is not a
best practice for most, however.

"Ronnie Vernon MVP" wrote:

> Jeremy
>
> I don't think changing a user account type is logged in the event viewer. It
> would take an admin account to perform this type of action.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User

Ronnie Vernon MVP

Guest
Posts: n/a

Re: User Account Permissions changed...

Posted: 12-05-2007, 10:27 PM

Jeremy

Your assessment appears to be correct. Like you said, it's not considered a
best practice, but if there is a problem this would be a good way to resolve
it.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User

"Jeremy Mitchell" <JeremyMitchell@discussions.microsoft.com> wrote in
message news

38FFD8C-EFE5-4E0E-8D53-1A4C90B5B033@microsoft.com...

> Ronnie,
>
> Thanks for the response. After further investigation, if I am not
> mistaken,
> I believe this event would only be logged if the "Audit account
> Management"
> subcategory is enabled in the Local Security Policy on each PC, or the
> parent
> Audit Policy was enabled, which would turn on all auditing events. The IT
> person who elevated the user's permissions does have domain admin rights.
> I
> just wanted to try and find concrete evidence.
>
> From what I have read, when all auditing features are enabled, you should
> be
> able to go back and find anything that was done on the pc. This is not a
> best practice for most, however.
>
> "Ronnie Vernon MVP" wrote:
>
>> Jeremy
>>
>> I don't think changing a user account type is logged in the event viewer.
>> It
>> would take an admin account to perform this type of action.
>>
>> --
>>
>> Ronnie Vernon
>> Microsoft MVP
>> Windows Shell/User
>

LinkBack

Thread Tools

Display Modes

« Previous Thread | Next Thread »

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Posting Rules
You may not post new threads You may post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is On HTML code is Off Trackbacks are On Pingbacks are On Refbacks are On

Forum Jump

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Changed User name, but User folder name didnt get changed?	mbm	Windows Vista Administration	2	12-01-2007 06:36 PM
I changed my account name but...	Keech	Windows Vista Administration	1	05-23-2007 09:29 AM
Set permissions on user account	Jaclyn	Windows Vista Administration	0	04-23-2007 02:40 AM
Account permissions and Gaming	Bob the Dad	Windows XP Games	2	08-23-2003 11:28 PM
change local user account into domain user account ?	kevin	Windows XP Security & Administration	1	07-26-2003 09:27 AM