User Account Permissions changed...

Posted: 12-03-2007, 09:33 PM
I have searched the group and the web but havent found the specifics to where
I can find the answer to my question.

Where in Event viewer can I find what account was used to change a users
account group? The user was added to the local machine as an administrator.
I have searched Event Viewer but cannot find it in the logs. What is the
event ID for an account permission change?

Thanks for your help. Also, if this has been answered before, please post
the link.

User Account Permissions changed...


Responses to "User Account Permissions changed..."

Ronnie Vernon MVP
Guest
Posts: n/a
 
Re: User Account Permissions changed...
Posted: 12-05-2007, 04:30 AM
Jeremy

I don't think changing a user account type is logged in the event viewer. It
would take an admin account to perform this type of action.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Jeremy Mitchell" <JeremyMitchell@discussions.microsoft.com> wrote in
message news:1A4A358B-A1F5-4236-B1A7-5163F36CCEBF@microsoft.com...
>I have searched the group and the web but havent found the specifics to
>where
> I can find the answer to my question.
>
> Where in Event viewer can I find what account was used to change a users
> account group? The user was added to the local machine as an
> administrator.
> I have searched Event Viewer but cannot find it in the logs. What is the
> event ID for an account permission change?
>
> Thanks for your help. Also, if this has been answered before, please post
> the link.
>
Jeremy Mitchell
Guest
Posts: n/a
 
Re: User Account Permissions changed...
Posted: 12-05-2007, 01:59 PM
Ronnie,

Thanks for the response. After further investigation, if I am not mistaken,
I believe this event would only be logged if the "Audit account Management"
subcategory is enabled in the Local Security Policy on each PC, or the parent
Audit Policy was enabled, which would turn on all auditing events. The IT
person who elevated the user's permissions does have domain admin rights. I
just wanted to try and find concrete evidence.

From what I have read, when all auditing features are enabled, you should be
able to go back and find anything that was done on the pc. This is not a
best practice for most, however.

"Ronnie Vernon MVP" wrote:
> Jeremy
>
> I don't think changing a user account type is logged in the event viewer. It
> would take an admin account to perform this type of action.
>
> --
>
> Ronnie Vernon
> Microsoft MVP
> Windows Shell/User
Ronnie Vernon MVP
Guest
Posts: n/a
 
Re: User Account Permissions changed...
Posted: 12-05-2007, 10:27 PM
Jeremy

Your assessment appears to be correct. Like you said, it's not considered a
best practice, but if there is a problem this would be a good way to resolve
it.

--

Ronnie Vernon
Microsoft MVP
Windows Shell/User


"Jeremy Mitchell" <JeremyMitchell@discussions.microsoft.com> wrote in
message news38FFD8C-EFE5-4E0E-8D53-1A4C90B5B033@microsoft.com...
> Ronnie,
>
> Thanks for the response. After further investigation, if I am not
> mistaken,
> I believe this event would only be logged if the "Audit account
> Management"
> subcategory is enabled in the Local Security Policy on each PC, or the
> parent
> Audit Policy was enabled, which would turn on all auditing events. The IT
> person who elevated the user's permissions does have domain admin rights.
> I
> just wanted to try and find concrete evidence.
>
> From what I have read, when all auditing features are enabled, you should
> be
> able to go back and find anything that was done on the pc. This is not a
> best practice for most, however.
>
> "Ronnie Vernon MVP" wrote:
>
>> Jeremy
>>
>> I don't think changing a user account type is logged in the event viewer.
>> It
>> would take an admin account to perform this type of action.
>>
>> --
>>
>> Ronnie Vernon
>> Microsoft MVP
>> Windows Shell/User
>
 
LinkBack Thread Tools Display Modes
 


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Forum Jump


Similar Threads
Thread Thread Starter Forum Replies Last Post
Changed User name, but User folder name didnt get changed? mbm Windows Vista Administration 2 12-01-2007 06:36 PM
I changed my account name but... Keech Windows Vista Administration 1 05-23-2007 08:29 AM
Set permissions on user account Jaclyn Windows Vista Administration 0 04-23-2007 01:40 AM
Account permissions and Gaming Bob the Dad Windows XP Games 2 08-23-2003 10:28 PM
change local user account into domain user account ? kevin Windows XP Security & Administration 1 07-26-2003 08:27 AM