Take the 2-minute tour ×

In the process of planning for an upcoming deployment of an AD structure with a single forest, a top level empty root domain and two child domains—which will house two business units. Within each business unit there are 30 remote sites and head-quarters site. In opting to configure auditing in multiple items, the amount of security logs in the network will grow very quickly. Based on the details given, my question is; what tools does Microsoft (and other third-party) vendors have available to make gathering and interpreting of logs easier? If any, is it freeware, paid, or both? All help is greatly appreciated, thanks in advance.

share|improve this question
What version of Windows Server are you using? –  Christopher Oct 22 '10 at 4:16
It is Windows Server 2003 SP1 –  rlopez6570 Oct 22 '10 at 9:46

1 Answer 1

up vote 1 down vote accepted

Microsoft gives you squat, for free. You can get SCOM, the current version of MOM. They have a piece of it that is dedicated to log auditing. There are plenty of other commercial products too. You could roll your own with NTSysLog and a syslog server, running commercial or freeware on Linux or Windows. What's your budget?

Second question - What's your actual goal with the auditing? You say "gathering and interpreting", so it sounds like you expect someone to either spend some time with these logs, or react based on alerts. Can you flesh out what the planned usage is going to be?

share|improve this answer
Gathering and interpreting is basically having to do with an assigned individual keeping track of all activity that goes on. –  rlopez6570 Oct 22 '10 at 9:51
Wow, what a crappy job that will be :-) –  mfinni Oct 22 '10 at 12:43

Your Answer


