Re: Audit folder access

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Doug Sherman [MVP] (dsherman_at_nospam.tampabay.rr.com)
Date: 12/14/04 

Date: Tue, 14 Dec 2004 15:16:29 -0500

First you need to enable auditing on the machine. You can do this through
Local Security Policy or Group Policy. Administrative Tools/Local Security
Policy - expand Local Policies, click on Audit Policy, and in the right pane
double click on Audit object access - select Success and Failure.

Second, enable auditing on the desired folder. Open Windows Explorer, right
click on the folder and select Properties. Click the Security tab, click
the Advanced button, and click the Auditing tab. Click the Add button and
add the users/groups you want to audit. Results appear in Event
Viewer/Security on the local machine.

Doug Sherman
MCSE Win2k/NT4.0, MCSA, MCP+I, MVP

"Joel" <jwolfe(removethis)@digimarc.com> wrote in message
news:uClACuf4EHA.3388@TK2MSFTNGP15.phx.gbl...
> Files that are required for an application on our win2k3 domain controller
> have been mysteriously getting deleted from the hard drive. this has
> occured a few times now and I have replaced these files. What is the
> procedure for setting up auditing on that specific directory so I can see
> who or what is accessing that directory?
>
> Thanks, Joel
>
>

Relevant Pages

  • RE: Auditing file deletion
    ... regarding this in the security event log. ... Default Domain Controllers Policy. ... Click Computer Configuration, double-click Windows Settings, ... double-click Audit Policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: Auditing file deletion
    ... You won't have to wade through the tonnes of audit logs, but have to set filters to watch the activity you care about. ... The problem is that hundreds of other Object Access events get logged, not just the file and directory deletions. ... regarding this in the security event log. ... Default Domain Controllers Policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: Mission Impossible
    ... For instance you can enable auditing of account logons, logons, ... account management, privilege use, policy change, and object access. ... so if you do such audit only permissions you need for the ...
    (microsoft.public.windows.server.security)
  • Re: Detail display for audit policy
    ... manipulating with security such as Scriptlogic's Security Explorer ... If I want to audit the user permission. ... servers on which the folders reside, and you'll need to enable auditing on ... auditing through Group Policy, you can enable it in each server's Local ...
    (microsoft.public.windows.server.security)
  • RE: Auditing Workstation logons from DC
    ... You have already configured Domain Security Settings for Audit account ... the both Default Domain Controllers Policy and Default Domain Security ... GPO may be overriding the audit policy setting that you configured. ...
    (microsoft.public.windows.server.sbs)