You Cannot Locate the Audit Messages for a Particular Operation
Applies To: Windows Server 2008
Describes a specific problem with Message Queuing. Includes step-by-step instructions for fixing the problem.
This problem typically occurs when attempting to view security related events for a Message Queuing object for which you have established an audit policy. When this problem occurs, no audit messages are written to the security log of the computer that is the owner of the Message Queuing object despite having configured the appropriate audit policy.
Diagnosis
This problem occurs because security events are created in the security log on the computer that performs the operation, which is not necessarily the computer that is the owner of the object. Additionallly, audit messages are created in the security log only when a queue is opened, not each time a message is received or sent.
Resolution
To view security related events generated as a result of an audit policy for a Message Queuing object, open the security log on the computer that performs the operation.
To view security related events in Event Viewer
Click Start, point to Programs, point to Administrative Tools, and then click Event Viewer.
To connect to a remote computer right-click Event Viewer in the console tree and click Connect to Another Computer, then enter then name or IP address of the remote computer and click OK.
In the console tree, click Security.
Where?
- Event Viewer/Windows Logs/Security
Security related events for the computer are displayed in the detail pane of the Event Viewer.
Verification
Open the security log on the computer that performs the operation that is being audited to view the security related events.