Posts

Showing posts from July, 2008

Security Events You Can Safely Ignore

Well as a System Administrator you browse through literal 100.000 event logs every week. Below you will find a list posted by Microsoft. This list tells you which events you can safely ignore. This will make your life a bit easier.... (I hope)   You can find the original document here   Event IDs Occurrence Comments 538 User logoff This event does not necessarily indicate the time that the user stopped using the computer. For example, if the user turns the computer off without first logging off, or if the network connection to a share breaks, the computer might not record a logoff at all, or might record a logoff only when the computer notices that the connection is broken. 551 User initiates logoff Use Event 538, which confirms logoff instead. 562

TrueCrypt 6.0 !

TrueCrypt is changing fast it seems only yesterday when version 4 came out. When they released version 5 earlier this year with the support for encrypted filesystems I didn't think they would release version 6 anytime soon. But hey here it is and it should be pretty neat considering the following Ability to create and run an encrypted hidden operating system whose existence is impossible to prove (provided that certain guidelines are followed).  For more information, see the section Hidden Operating System .   ( Windows Vista/XP/2008/2003 ) For security reasons, when a hidden operating system is running, TrueCrypt ensures that all local unencrypted filesystems and non-hidden TrueCrypt volumes are read-only. (Data is allowed to be written to filesystems within hidden TrueCrypt volumes .) Note: We recommend that hidden volumes are mounted only when a hidden operating system is running. For more information, see the subsection Security Precautions Pertaining