| Open-AudIT https://www.open-audit.org/phpBB3/ |
|
| discovery 2.0.6 https://www.open-audit.org/phpBB3/viewtopic.php?f=20&t=6629 |
Page 1 of 1 |
| Author: | caninfo [ Tue Sep 26, 2017 9:55 pm ] |
| Post subject: | discovery 2.0.6 |
I've update open audit to v2.0.6 when i run a discovery, audit_windows doesn't work good, i've this in my log : Windows audit is running as LocalSystem, not ideal for 192.168.1.1 i never see this message in the previous version. Any idea ? |
|
| Author: | jpa [ Fri Sep 29, 2017 9:23 am ] |
| Post subject: | Re: discovery 2.0.6 |
It's a permissions issue with some of the newer auditing features. The explanation isn't immediately discover-able but see the Files Auditing help section entitled "Enabling the Feature Under Windows" [url=https://community.opmantek.com/display/OA/Files]here[/url]. Quoted for easy reference: [code]Enabling the Feature Under Windows There is no need to do anything if you're running Open-AudIT on a Linux server. Windows clients are just fine and require no special actions, however.... to enable this feature the audit script must be run locally on the target Windows system. It cannot be run remotely as we do with WMI calls when running the audit script on one Windows machine, while targeting a second Windows machine. To do this we need to copy the audit script to the target Windows machine and then run it. Unfortunately the service account that Apache runs under is the Local System account. This account has no access to remote (network based) resources. To work around this issue the service must be run under another account. It is easiest to just use the local Administrator account, but you can try any account you like as long as it has the required privileges. The Local System account has as much local access as the local Administrator account.[/code] |
|
| Page 1 of 1 | All times are UTC + 10 hours |
| Powered by phpBB® Forum Software © phpBB Group https://www.phpbb.com/ |
|