Auditing Changes in SCM Not Reflected in User Manager Policies

• Microsoft Windows NT Server versions 4.0 SP4, 4.0 SP5
• Microsoft Windows NT Server, Enterprise Edition versions 4.0 SP4, 4.0 SP5

SYMPTOMS

When you attempt to use the Security Configuration Manager (SCM) tool to remove two auditing events that are being tracked for an attribute in User Manager for Domains (for example, auditing Success and Failure events for the Audit Object Access attribute), you can only remove one auditing event. If you are tracking two auditing events for an attribute in User Manager for Domains on your Windows NT 4.0-based computer, the SCM tool can add an auditing event successfully to the tracking that is reflected in User Manager for Domains.

CAUSE

This behavior occurs because of an incorrect flag set in the Local Security Authority (LSA) server library.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows NT 4.0. For additional information, please see the following article in the Microsoft Knowledge Base:

Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

STATUS

Microsoft has confirmed this to be a problem in Windows NT 4.0. This problem was first corrected in Windows NT 4.0 Service Pack 6.

MORE INFORMATION

For additional information about the Microsoft Security Configuration Tool Set, including Security Configuration Manager, please visit the following Microsoft Web site:

http://www.microsoft.com/technet/win2000/

Additional query words:

Keywords : kbtool ntdomain ntsecurity ntsp kbbug4.00 kbfix4.00 NT4SP6Fix
Version : winnt:4.0 SP4,4.0 SP5
Platform : winnt
Issue type : kbbug