 |
|
|
|
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 wrote:
> Newsflash: If your administrators can't be trusted, you have A Big Problem.
Not true. It's certainly easier to trust your administrators. But being able
to audit the administrators is probably a good idea.
>> Not really. That's the easiest way to do it, but it isn't necessary.
>> Everything about the user is stored in the file system, so...
>
> Yeah, sure, because it's really easy to figure out how every random
> screwed up app designed for Windows 95 is using the filesystem to store
> its stuff, right?
I didn't say it was easier. I said it was possible. If it's actually enough
of a problem, you'll buy a new program that works with remote management
technologies, or you'll hire someone to figure out where stuff is stored.
>> If you knew how to work it, you could do it. Do you think people at
>> Microsoft or American Express hang around to enter their passwords
>> while the sysadmin fixes things?
>
> Presumably they don't use obscure, badly designed software...
Or they hire someone to work out what they need to do to fix things.
>>> - Allow Administrators to unlock a workstation without destroying all
>>> of the user's unsaved work. (IOW, without terminating all the stuff
>>> they have running.)
>>
>> Wouldn't be much of a lock, would it?
>
> Why? Because one person in the building can unlock it? (Note that the
> administrator can *already* unlock it - as can anybody else by using the
> on/off switch, come to think of it.)
No. They can't unlock the programs running on the machine under another user
ID. They can only unlock the entire machine.
> It would just be nice if somebody
> goes home and forgets to save their work if I didn't have to destroy all
> that work.
Why would you log them out? Let it run. Open a new session if someone else
needs to use the same console.
>> You didn't provide the actual interesting information, which is the
>> Event ID.
>
> Yes, but you get my *point*. Turn on auditing, perform a few trivial
> actions, watch your event log fill with many megabytes of data that
> nobody knows what it means.
Because *you* don't know what it means doesn't mean *nobody* knows what it
means.
> As far as I can tell, M$ hasn't actually documented many of them yet.
As far as you could tell, MS didn't document what programs you get when you
buy Office Home. That isn't saying much. ;-)
> (E.g., the HD light is flashing away, yet PE shows no
> I/O activity.)
NTFS slowly commits the log out to the disk. If you do something big, it
might take 20 or 30 seconds to finish in the background after it has already
been committed. Try running "sync", and then see if it still happens.
> Actually, I used to say that about XP. Let me rephrase: I hope I never
> have to use Vista before they're finished fixing it. ;-)
Dunno. Works great for me. You seem to have bad luck, tho, so... Wait for
Win7SP1. ;-)
--
Darren New, San Diego CA, USA (PST)
"Ouch ouch ouch!"
"What's wrong? Noodles too hot?"
"No, I have Chopstick Tunnel Syndrome."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> Invisible wrote:
>> - Allow Administrators to pretend to be another user, without having
>> to know that user's password.
>
> Sure. We all wish security would let administrators make changes to the
> system they could blame on other users. :-)
>
>> There are times when, in order to configure something, you have to log
>> in under the user's account before you can configure it.
>
> Not really. That's the easiest way to do it, but it isn't necessary.
> Everything about the user is stored in the file system, so...
>
> If you knew how to work it, you could do it. Do you think people at
> Microsoft or American Express hang around to enter their passwords while
> the sysadmin fixes things?
>
>> - Allow Administrators to unlock a workstation without destroying all
>> of the user's unsaved work. (IOW, without terminating all the stuff
>> they have running.)
>
> Wouldn't be much of a lock, would it?
>
>> - Log security events in a meaningful way.
>> Do you know what
>>
>> Object Access Attempt:
>> Object Server:Security
>> Handle ID:144
>> Object Type:File
>> Process ID:3156
>> Image File Name:C:\WINDOWS\system32\notepad.exe
>> Accesses:WriteData
>> Access Mask:0x6
>>
>> means? I certainly don't.
>
> You didn't provide the actual interesting information, which is the
> Event ID.
>
> http://www.microsoft.com/technet/support/ee/ee_advanced.aspx
>
>> But then, this isn't human-readable data. This is simply a raw dump of
>> the low-level internal data structures that Windows itself uses to
>> manage object access.
>
> Not really. It's the codes the OS passed to be recorded in the event logs.
>
>> As it is, all over the company we have event logs full of gibberish
>> like this that nobody can understand. We might as well not bother
>> logging it...
>
> Or, alternately, you could learn what the codes mean.
>
Because.. Providing administrators with... I don't know, something that
could tell them, so they don't have to look it up, or memorize 4,000
codes, would just what? Make too much sense? lol
--
void main () {
If Schrödingers_cat is alive or version > 98 {
if version = "Vista" {
call slow_by_half();
call DRM_everything();
}
call functional_code();
}
else
call crash_windows();
}
<A HREF='http://www.daz3d.com/index.php?refid=16130551'>Get 3D Models,
3D Content, and 3D Software at DAZ3D!</A>
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> Orchid XP v8 wrote:
>> Newsflash: If your administrators can't be trusted, you have A Big
>> Problem.
>
> Not true. It's certainly easier to trust your administrators. But being
> able to audit the administrators is probably a good idea.
>
>>> Not really. That's the easiest way to do it, but it isn't necessary.
>>> Everything about the user is stored in the file system, so...
>>
>> Yeah, sure, because it's really easy to figure out how every random
>> screwed up app designed for Windows 95 is using the filesystem to
>> store its stuff, right?
>
> I didn't say it was easier. I said it was possible. If it's actually
> enough of a problem, you'll buy a new program that works with remote
> management technologies, or you'll hire someone to figure out where
> stuff is stored.
>
>>> If you knew how to work it, you could do it. Do you think people at
>>> Microsoft or American Express hang around to enter their passwords
>>> while the sysadmin fixes things?
>>
>> Presumably they don't use obscure, badly designed software...
>
> Or they hire someone to work out what they need to do to fix things.
>
>>>> - Allow Administrators to unlock a workstation without destroying
>>>> all of the user's unsaved work. (IOW, without terminating all the
>>>> stuff they have running.)
>>>
>>> Wouldn't be much of a lock, would it?
>>
>> Why? Because one person in the building can unlock it? (Note that the
>> administrator can *already* unlock it - as can anybody else by using
>> the on/off switch, come to think of it.)
>
> No. They can't unlock the programs running on the machine under another
> user ID. They can only unlock the entire machine.
>
>> It would just be nice if somebody goes home and forgets to save their
>> work if I didn't have to destroy all that work.
>
> Why would you log them out? Let it run. Open a new session if someone
> else needs to use the same console.
>
>>> You didn't provide the actual interesting information, which is the
>>> Event ID.
>>
>> Yes, but you get my *point*. Turn on auditing, perform a few trivial
>> actions, watch your event log fill with many megabytes of data that
>> nobody knows what it means.
>
> Because *you* don't know what it means doesn't mean *nobody* knows what
> it means.
>
Snort. Been in this situation a few times. Go to MS site, either not
find anything on it at all, or find something so moronically unhelpful
that you might as well as asked the family dog, "Bark, bark!". "Well,
you are real helpful, I already knew it was application X that crashed,
I want to know fracking *why*!" lol Seriously, again, why not something
that at least told you want the codes "mean" in some usable way, as one
of the available tools?
--
void main () {
If Schrödingers_cat is alive or version > 98 {
if version = "Vista" {
call slow_by_half();
call DRM_everything();
}
call functional_code();
}
else
call crash_windows();
}
<A HREF='http://www.daz3d.com/index.php?refid=16130551'>Get 3D Models,
3D Content, and 3D Software at DAZ3D!</A>
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Patrick Elliott wrote:
> that at least told you want the codes "mean" in some usable way, as one
> of the available tools?
Did you try putting the code into the link I offered? You know, the one with
the drop-down box letting you specify the program, the code, the sub-code,
and it spits back an explanation?
--
Darren New, San Diego CA, USA (PST)
"Ouch ouch ouch!"
"What's wrong? Noodles too hot?"
"No, I have Chopstick Tunnel Syndrome."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Orchid XP v8 wrote:
> As far as I can tell, M$ hasn't actually documented many of them yet.
http://learning.microsoft.com/Manager/Catalog.aspx?clang=en-US&dtype=Table&Sort=PublicationDateDescending&page=1&cats={2b4bc3f6-ff30-4b97-9188-b4f919a7f6f8}%3a{43456be0-e861-40a0-b351-0a4070381ad1}%3a{2d583e34-2bcf-4ed8-bfbb-34bb1612f8d4}
--
Darren New, San Diego CA, USA (PST)
"Ouch ouch ouch!"
"What's wrong? Noodles too hot?"
"No, I have Chopstick Tunnel Syndrome."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Patrick Elliott wrote:
> Because.. Providing administrators with... I don't know, something that
> could tell them, so they don't have to look it up,
Providing administrators with something that would tell them what the event
codes mean without having to look up what the event codes mean? What?
How about a web site that lets you look up what event codes mean which?
--
Darren New, San Diego CA, USA (PST)
"Ouch ouch ouch!"
"What's wrong? Noodles too hot?"
"No, I have Chopstick Tunnel Syndrome."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
>
> How about a web site that lets you look up what event codes mean which?
>
That's great when you have internet on hand. If you're "out on the
field", it possibly ain't that great anymore.
-Aero
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> Patrick Elliott wrote:
>> that at least told you want the codes "mean" in some usable way, as
>> one of the available tools?
>
> Did you try putting the code into the link I offered? You know, the one
> with the drop-down box letting you specify the program, the code, the
> sub-code, and it spits back an explanation?
>
Would be "so" useful if... I don't know, I was some place where there
wasn't any internet, or FSM forbid, the "bug" caused loss of access to
that, now wouldn't it. MS' recent foray into "cloud computing" stuff
makes me laugh for do to that. ISP can't keep me live reliably 100% of
the time (and I really doubt anyone else is *guaranteed* service either,
but I am supposed to rely on someone else's servers to "run"
applications I need... Might as well got back to horse and buggy and
"rent" someone else's horses to pull you around, while hoping the local
farm's pasture fence doesn't break 5 minutes before I need to go some
place, letting all the horses escape...
Web pages like that are worthless, if you can't get to them. Its the
same reason that, despite pages of documentation on the Windows API,
people thought writing API-Guide was a good idea. Looking something up
"locally", on software you actually have installed "works", unless its
the software that is broken. Looking it up on a web page you have at
least 5-6 points of failure on "your" end, plus another 5+, to as much,
in the worst case, of possibly a total of 30, or more, points of
failure, to get to that web page. Just plain logic demands that its
"not" as good as having something "in hand".
--
void main () {
If Schrödingers_cat is alive or version > 98 {
if version = "Vista" {
call slow_by_half();
call DRM_everything();
}
call functional_code();
}
else
call crash_windows();
}
<A HREF='http://www.daz3d.com/index.php?refid=16130551'>Get 3D Models,
3D Content, and 3D Software at DAZ3D!</A>
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Patrick Elliott wrote:
> Would be "so" useful if... I don't know, I was some place where there
> wasn't any internet, or FSM forbid, the "bug" caused loss of access to
> that, now wouldn't it.
I'm not real sure what you expect, then. Go buy the book that lists all the
codes, maybe? How many of them do you think you're going to look up?
> Just plain logic demands that its
> "not" as good as having something "in hand".
And if this really is a frequent problem for you, you go buy the book. Be
forewarned: it's pretty friggin big. Do you really need a complete list of
every event ever logged by any piece of hundreds of megabytes of code?
--
Darren New, San Diego CA, USA (PST)
"Ouch ouch ouch!"
"What's wrong? Noodles too hot?"
"No, I have Chopstick Tunnel Syndrome."
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
| |
|
|
Darren New wrote:
> Patrick Elliott wrote:
>> Would be "so" useful if... I don't know, I was some place where there
>> wasn't any internet, or FSM forbid, the "bug" caused loss of access to
>> that, now wouldn't it.
>
> I'm not real sure what you expect, then. Go buy the book that lists all
> the codes, maybe? How many of them do you think you're going to look up?
>
>> Just plain logic demands that its "not" as good as having something
>> "in hand".
>
> And if this really is a frequent problem for you, you go buy the book.
> Be forewarned: it's pretty friggin big. Do you really need a complete
> list of every event ever logged by any piece of hundreds of megabytes of
> code?
>
Sigh.. Software, not a web page. Yes, software is easier, but web pages
are only convenient "if" you can get to them. That is the point. As for
books.. Gah.. Same situation as with API-Guide. I own most of the books
covering the stuff in that program, and its "easier" to find the stuff
in API-Guide, not to mention that the "examples" in it tend to be far
more helpful than the, sometimes, too lean and incomplete ones in the
book. Favorite has got to the the "assumption" that every one of them
has that you are a) using VC, not anything else, and you "don't need to
know" what a flag value is, since you can just plug in the .h file for
it, the reference the name in your code. Yep, that works "so" well, if
you are trying to access the API via VB, or worse, a Lua wrapper. lol
Too much to have something "someplace" in one of their dozens of books
that listed the actual flags and what their "values" are? Apparently...
:p After all, its makes so much more sense to buy a $600 compiler you
don't need, than a $50 book you "do". ;)
--
void main () {
If Schrödingers_cat is alive or version > 98 {
if version = "Vista" {
call slow_by_half();
call DRM_everything();
}
call functional_code();
}
else
call crash_windows();
}
<A HREF='http://www.daz3d.com/index.php?refid=16130551'>Get 3D Models,
3D Content, and 3D Software at DAZ3D!</A>
Post a reply to this message
|
|
| |
| |
|
|
|
|
| |
|
|
