Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 2236 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Tamper Protection Reports

Sizzle69

Hi there,

Is there any way to report on Tamper Protection events? Has anyone managed to do this before? I've checked out the Enterprise Console 4.5 report tool but it doesn't seem to allow me to select anything to do with Tamper Protection.

I'm assuming an SQL query against the actual database would be the best option. Any advice would be greatly appreciated.

Cheers!

:15429


This thread was automatically locked due to age.
  • 0

    Hello Sizzle69,

    also not selectable in 4.7 as far as I can see (you'll guess I could do without it up to now). Well, a quick solution would be exporting the events from the Event viewer (View->Tamper protection events ...) as CSV.

    HTH

    Christian

    :15433
  • 0

    Cheers Christian. I managed to find it online right at the point I received an email to say you've replied. Thanks for your help.

    :15435
  • 0

    If somebody else is wondering:

    From:

    /search?q= 4979

    Tamper protection events
    Description:
    Shows all tamper protection events.
    Query:
    SELECT tb2.EventTime, tb1.Name AS Computer, tb2.UserName, tb3.Target
    FROM ComputersAndDeletedComputers AS tb1, Events AS tb2, Events_TamperProtectionData AS tb3
    WHERE tb2.EventType = 5
    AND tb2.ComputerID = tb1.ID
    AND tb3.EventID = tb2.ID
    ORDER BY tb2.EventTime DESC
    Example Result:
    29-10-2010 14:23 - PC1000 - domain\user - Sophos Anti-Virus

    :15441