A SCOM rule to detect security event ids and email you when a Policy Change is detected in the event logs would be my first port of call...assuming you have/can afford SCOM
2009/6/5 Brumbaugh, Luke <[email protected]> > Long story short, the default domain policy got enforced and over wrote > an exchange server audit rights. > > Which busted the mail server. My question, is there a setting or > software package that could tell me when an admin changes a policy and what > setting got changed. > > I had this happen before and of course, nobody admits to doing it or might > have done it accidentally. > > > > Any help would be appreciated. > > > > > > *Luke L. Brumbaugh* > > Network Engineer > > Butler Animal Health Supply > > Ph:(614) 659-1736 > > > > ********************************************************************** > > CONFIDENTIALITY NOTICE: The information transmitted in this message is > intended only for the person or entity to which it is addressed and may > contain confidential and/or privileged material. Any review, retransmission, > dissemination or other use of this information by persons or entities other > than the intended recipient is prohibited. If you received this in error, > please contact the sender and destroy all copies of this document. Thank > you. > > Butler Animal Health Supply > > ********************************************************************** > > > > > > > > ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
