SarBox Reporting Questions

[Guest]

In the never ending battle to please the auditors they come up with some of the "best" questions.

I gave them a dump of all users on the domain (first mistake) and he's sorted by each column. He wants to know the difference between the output (none) vs a blank field. For example "lockout time" I have come to the conclusion that (none) = never locked out by the group policy, where a blank field means it's been locked out in the past or vice versa... Is this a correct assumption or am I way off track. He wants to know the difference between (none) vs blank field for pw last set, expires, last logon and lockout time. Any direction will be greatly appreciated. I searched the forums to no avail. thanks guys.

[cmccullough]

Re: SarBox Reporting Questions

I believe that a (none) is used when there is an actual 0 in the data field, and blank is because the data is actually blank. We aren't sure why Microsoft uses one versus the other in various fields. I'm sure like you've theorized that it's the difference between the value never being set versus it being reset.

[kstanush]

Re: SarBox Reporting Questions

Yes, that is correct. When a zero is found, it is replaced with (none). A blank means the attribute does not exist in the directory at all.