Additional Reading

• For Windows Server 2003, the Microsoft Windows Security Resource Kit by Ben Smith and Brina Komar (Microsoft Press, 2003) is the definitive guide to what you can, should, and should not audit. The Windows 2000 Security Resource Kit (Microsoft Press, 2002) is the equivalent source for Windows 2000 security information. These guides are heavy reading, but the effort is well worth it.

• For Windows 2000, the Security Operations Guide for Windows 2000 is a book-length guide of security practices and settings published by Microsoft. It provides much more detail on good policies and practices, and I encourage you to download it from http://www.microsoft.com/downloads/release.asp?releaseid=37123 , read it, and follow it as part of your ordinary security policies.

• The Windows Server 2003 Security Guide (available on Microsoft TechNet; see http://www.microsoft.com/technet/security/prodtech/win2003/w2003hg/sgch00.asp ) is another very useful reference for Windows Server 2003 administrators.

• Counterpane Systems maintains a nifty page of log analysis tools and information at http://www.counterpane.com/log-analysis.html .

• The Windows Scripting Solutions newsletter ( http://www.winscriptingsolutions.com ) occasionally features articles with useful event log scripts. For example, Dave Roth s Progressive Perl for Windows: Taking Advantage of the Event Log ( http://www.winscriptingsolutions.com/Articles/Index.cfm?ArticleID=16404 ) includes a number of interesting tips.

• There s a terrific site for deciphering event log messages: http://www.eventid.net . Most of the event message descriptions there were posted by other users, so if you encounter an event and have to call the Microsoft Product Support Services (PSS) team to find out what it means, be sure to post your findings there for your fellow administrators benefit.