Admin Tips
- Windows Server 2008/2003/2000/XP/NT Administrator Knowledge Base
  - Windows 2003
    - Admin Tips
      - Security
        Protect Your Security Logs

Section(s): Admin , Security
Published on Jul 26, 2005.
Last Modified on Jul 26, 2005.
Last Modified by Mitch Tulloch.
Rated 1.4 out of 5 based on 5 votes.

Tip on how to protect your Security logs.

What's the best way to protect your servers against a rogue admin using a tool like Winzapper to cover their tracks? Regularly archive the Security logs on all your servers to a secure location that only you have access to. You might try robocopy.exe and schtasks.exe as a simple solution for this, or you can use one of the integrated log monitors available from third-party vendors, or you can wait for Microsoft's Audit Collection Services (ACS) to be released soon.

About Mitch Tulloch

Mitch Tulloch is a widely recognized expert on Windows administration, networking, and security. He has been repeatedly awarded Most Valuable Professional (MVP) status by Microsoft for his outstanding contributions in supporting users who deploy and use Microsoft platforms, products and solutions. Mitch has published over two hundred articles on different IT websites and magazines, and he has written or contributed to almost two dozen books and is lead author for the Windows 7 Resource Kit from Microsoft Press. For more information, see www.mtit.com .