how can determine what gpo applied to a comp and who made the chan

Discussion in 'Security Software' started by Ralph, Oct 28, 2004.

  1. Ralph

    Ralph Guest

    HI,

    I'm looking for log that could tell me when a specific GPO has been applied
    to a computer, I know that you can determine that a GPO has been apllied to
    a computer by looking into the eventvwr for

    Event Type: Information
    Event Source: SceCli
    Event Category: None
    Event ID: 1704
    Date: 27/10/2004
    Time: 4:58:29 PM
    User: N/A
    Computer: 043-RAOULDMB
    Description:
    Security policy in the Group policy objects has been applied successfully.

    MY concern is more about when a specifis GPO has been applied and maybe what
    settings, was applied to the computer,

    On the second hand i would like to know when people make change to a GPO,
    where are the object access entries are logged when using the administrative
    tools from the workstation. in other words is there any way to find when and
    who made changes to a pecific GPO, and where should i look for this type of
    information.

    Thanks

    Ralph
     
    Ralph, Oct 28, 2004
    #1
    1. Advertisements

  2. Ralph

    Miha Pihler Guest

    Hi Ralph,

    You didn't specify what operating system you use. If you are running Windows
    XP or Windows 2003 run rsop.msc from command line or Start -> Run option.
    RSOP is Resultant Set of (Group) Policy. It is a tool that will tell which
    policy is applied and in effect based on computer and user object in AD (in
    which domain and OU they are placed)...

    Here is an example http://freeweb.siol.net/mpihler/rsop.jpg

    I hope it helps,

    Mike
     
    Miha Pihler, Oct 28, 2004
    #2
    1. Advertisements

  3. Ralph

    Ralph Guest

    Thanks you for your answer,

    i think i haven't been clear, my goal is to track all the gpo that have been
    applied on the computer over time, i'm looking for a log file that can tell
    me by date since my worksatation is connected to the domain, when and what
    gpo was applied. i have looked on the different log file and find
    winlogon.log file that look close to what i'm looking but this only track
    when the user logon, and does not keep the data for a long period. hope this
    will make it more clear and that there is such type of log in windows.


    ralph
     
    Ralph, Oct 29, 2004
    #3
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.