The 'Group Change in X Days' report does not reflect that a group member was deleted. (NETIQKB32023)

  • 7732023
  • 02-Feb-2007
  • 08-Sep-2008

Resolution

fact
VigilEnt Security Manager 2.x

fact
NetIQ Vulnerability Manager 5.5

fact
VigilEnt Security Manager 3.x

fact
VigilEnt Security Manager 4.x

fact
NetIQ Vulnerability Manager 5.0

symptom
The 'Group Change in X Days' report does not reflect that a group member was deleted.

change
A 'Group Change in X Days' report was run after deleting a group member.

cause
Event ID?s 631 through 638 are not in the Security Log, the log is full and cannot write to itself, or auditing is not turned on.

fix

Verify that auditing is turned on to track for these type of events and verify that the log is not full. To do this follow the steps below.

  1. Click Start | Settings | Control Panel.
  2. If using Windows NT, select Local Security Policy If using Windows 2000, select Administrative ToolsLocal Security Policy.
  3. Select Local Policies.
  4. Select Audit Policy.
  5. Select Audit Account Management | Audit These Attempts , select Success and Failure, and click OK.
  6. Select Audit Account Account Logon EventsAudit These Attempts , select Success and Failure, and click OK.

It is recommended that you set the log to overwrite as needed. To do this, follow these steps:

  1. Open the Event Viewer.
  2. Highlight the Security Log, right click, and select Properties.
  3. Select Overwrite As Needed.


Additional Information

Formerly known as NETIQKB32023