Re: Auditing Folders and Files - Audit Policy - Audit Object Access

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 12/31/04 

Date: Fri, 31 Dec 2004 02:52:45 GMT

Make sure on that server that auditing of object access is indeed enabled.
Open Local Security Policy and look at the "effective" settings if the
server is Windows 2000. If the local and effective settings are different
then you have a domain or Organizational Unit Group Policy overriding local
policy and you will have to enable auditing of object access at that level
or put the server in it's own OU with it's own GPO to configure the policy.
The support tool gpresult can help determine which "computer" policies are
applying to a domain computer. If the file server is a domain controller,
you will have to configure in Domain Controller Security Policy. --- Steve

"Joanne" <Joanne@discussions.microsoft.com> wrote in message
news:74B79AAB-BDBE-4B25-91EA-014D7427F4C5@microsoft.com...
>I am trying to track/audit the access of some folders and files at our file
> server. Wanted to know who deleted some stuffs.
>
> Have followed the steps advised in the below link, but I still couldn't
> get
> it to work:
> http://support.microsoft.com/Default.aspx?kbid=300549
>
> Here is what I did:
>
> 1) At the file server, Local Security Settings, Local Policies, Audit
> Policies, I enabled Audit Object Access to track Success\Failure.
>
> 2) Then, I went to that particular subfolder, Properties, Security,
> Advanced, Audit and entered the usernames, groups and access that I'd like
> have audited.
>
> 3) I did some test by creating and deleting files in the subfolder. After
> that, I checked at the file server's Security Log but nothing happens. It
> only tracks the default Logon/Logoff Success Audits.
>
> I have admin rights and have tested few times. Could someone help?
>

Relevant Pages

  • RE: Cant set Local Security policies. They fail to save
    ... predefined Security Template on SBS 2003 to restore security groups ... run "gpupdate.exe /force" under command prompt to force the policy ... reboot the Server to test. ... and then logon to client computer to test if user can save system logs. ...
    (microsoft.public.windows.server.sbs)
  • Re: Security Logon/Logoff Events
    ... the full security audit is enabled by default so that you are ... Right-click Small Business Server Auditing Policy and click Edit. ... SBS 2003 creates a GPO on the DC container named Small Business Server ...
    (microsoft.public.windows.server.sbs)
  • Re: Group Policy is now inhibiting the Administrator account
    ... under Group Policy Objects - those are the individual GPOs. ... You can apply any given GPO to one or more OUs, ... I use all of the default security in SBS, ... log on to the server with your own account. ...
    (microsoft.public.windows.server.sbs)
  • Re: Moved & Deleted Files
    ... share will not go to the recycle bin on the server. ... For Windows 2000 you can enable auditing of object access in the Local ... Security Policy or Domain Controller Security Policy for domain controllers ... and then audit folders for user access. ...
    (microsoft.public.security)
  • RE: SBS 2003 Lost all the Security Policies.
    ... Policy or Domain Security Policy it is empty. ... Also your Exchange server is ... Exchange problem in our newsgroup. ...
    (microsoft.public.windows.server.sbs)
Loading