Using Windows Server 2003 in a Managed Environment
Event Viewer
On This PageBenefits and Purposes of Event ViewerUsing Event Viewer, administrators can view and set logging options for event logs in order to gather information about hardware, software, and system problems. By default, a computer running an operating system in the Microsoft Windows Server 2003 family records events in three kinds of logs:
A computer running a Windows Server 2003 family operating system which is configured as a domain controller records events in two additional logs:
A computer running a Windows Server 2003 operating system configured as a Domain Name System (DNS) server records events in an additional log. The DNS server log contains Windows DNS service events. Other types of events and event logs might be available on a computer, depending on what services are installed. Overview: Using Event Viewer in a Managed EnvironmentThe Event Log service starts automatically when you start the operating system. Administrators access event logs for a server through Control Panel\Administrative Tools\Event Viewer. They can obtain detailed information about a particular event by either double-clicking the event, or by selecting the event and clicking Properties on the Action menu. The dialog box gives a description of the event, which can contain one or more links to Help. Links can either be to servers at Microsoft, or to servers managed by the software vendor for the component that generated the event. On products in the Windows Server 2003 family, most events that originate from Microsoft products will have standard text containing a URL at the end of the description ("For more information, see Help and Support Center at go.microsoft.com/fwlink/events.asp"). When you click the link, you are asked to confirm that the information presented can be sent over the Internet. If you click Yes, the information listed will be sent to the Web site named in the link. The parameters in the original URL will be replaced by a standard list of parameters whose contents are detailed in the confirmation dialog box. This list is provided in the next subsection under "Specific information sent or received." In a highly managed environment, IT administrators might want to prevent users and administrators from sending this information over the Internet through this link and accessing a Web site. In the Windows Server 2003 family, this information flow is governed by a registry key. Administrators can edit this registry key to prevent users and administrators from accessing the Internet through Event Viewer. How Event Viewer Communicates with Sites on the InternetIn order to access the relevant Help information provided by the link in the Event Properties dialog box, you must send the information listed about the event. The collected data is confined to what is needed to retrieve more information about the event from the Microsoft Knowledge Base. User names and e-mail addresses, names of files unrelated to the logged event, computer addresses, and any other forms of personally identifiable information are not collected. The exchange of information that takes place over the Internet is described as follows:
Controlling Event Viewer to Prevent the Flow of Information to and from the InternetYou can prevent users and administrators from sending information across the Internet and accessing Internet sites through Event Viewer by editing the registry. When you edit the registry as described in the following subsection, clicking Yes as previously described will still start Help, but it will not access the Internet for information specific to the event. The Windows Server 2003 family computer registry values listed in this subsection are located in the following registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Event Viewer The following list describes how this registry key controls the flow of information to and from the Internet.
Note: If any of these registry values is missing or empty, the link will be started directly using ShellExecute; deleting these values is not a method for preventing information from reaching the Internet. Procedures for Preventing the Flow of Information to and from the Internet Through Event ViewerTo prevent the flow of information to and from the Internet through Event Viewer you need to edit the registry. You can then apply the registry change to computers in a domain using Group Policy. Editing the RegistryEdit HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Event Viewer as follows: To prevent the user from accessing the Internet when they click the link, delete the final "%s" from the value of MicrosoftRedirectionProgramCommandLineParameters (see the list in the previous subsection). With this change, clicking the link and clicking Yes will still start Help, but it will not access the Internet for information specific to this event. For more information about the registry, see the Registry Reference for Windows Server 2003 on the Microsoft Windows Server 2003 Deployment Kit companion CD, or on the Windows Deployment and Resource Kits Web site at: Caution Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. You can also use the Last Known Good Configuration startup option if you encounter problems after manual changes have been applied. Distributing the Registry Change Using Group PolicyYou can distribute this registry change to computers in a domain by configuring a Group Policy object (GPO). You first need to create a template using the Event Viewer snap-in as described in the following procedure. To Enable the Event Viewer Group Policy Snap-in
|
In This Article
|
