Re: Windows 2000 Auditing Object Access

This statement from your original post looks like your problem.

"I have enabled object access via the default domain controllers policy and
have set auditing on a particular
object in Active Directory however I never see anything in the security logs
when I try to test by changing, deleting or modifying files."

The default domain controllers policy applies to domain controllers. You'll
need to configure a policy on an OU which contain the servers which you want
to audit. You could, edit the Default Domain Policy for this, but I suggest
you do it on an OU which contain your servers. Call it "Member Servers".

--
Todd J Heron, MCSE
Windows Server 2003/2000/NT; CCA
----------------------------------------------------------------------------
This posting is provided "as is" with no warranties and confers no rights

"Ken" <Ken@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:01B33A28-CE83-42EB-A235-B48A03336B88@xxxxxxxxxxxxxxxx
Yes I have that document in hand. I am just trying to get this up an running
I am trying to audit folders for success/failure and I am looking at the
security log in event viewer. The folder has auditing set but when tested by
deleting test folders and creating text files etc nothing shows up in event
viewer.

"Ian" wrote:

> Ken wrote:
> > Hopefully someone can guide me in the right direction. I am unable to
> > get the
> > Auditing of Object Access to work. I have enabled object access via the
> > default domain controllers policy and have set auditing on a particular
> > object in Active Directory however I never see anything in the security
> > logs
> > when I try to test by changing, deleting or modifying files. The object
> > has
> > been set to Audit everything however nothing is showing up in the logs.
> > When
> > I look at the local security logs is shows no effective permissions for
> > the
> > audit policy. Can anyone provide me any insight on this ?
> >
> > Thanks,
> >
> > Ken
> Ken,
>
> A Step by step guide from ms:
> http://support.microsoft.com/default.aspx?scid=kb;en-us;314955&sd=tech
>
> What are you auditing and what logs are you looking at?
>
> Ian
>

.

Relevant Pages

  • Re: Windows 2000 Auditing Object Access
    ... I have enabled object access via the default domain controllers policy and have set auditing on a particular object in Active Directory however I never see anything in the security logs when I try to test by changing, ...
    (microsoft.public.windows.server.general)
  • RE: Critical Errors in Server Performance Report
    ... You turn off auditing for the Object Access category and the Directory ... Microsoft CSS Online Newsgroup Support ... This newsgroup only focuses on SBS technical issues. ...
    (microsoft.public.windows.server.sbs)
  • HELP - File Auditing
    ... not automatically trigger any new "object access" audit ... individual objects for audit events to be logged. ... To enable auditing on a file/directory do the following: ... GPEDIT.msc in that server, ...
    (microsoft.public.win2000.security)
  • RE: Critical Errors in Server Performance Report
    ... Failure Auditing is turned ON, these events will definitely be seen. ... You turn on auditing for the Object Access category and the Directory ... Microsoft CSS Online Newsgroup Support ... Critical Errors in Server Performance Report ...
    (microsoft.public.windows.server.sbs)
  • Re: Software auditing: Which one and who installed it
    ... There is not built in auditing for such and third party programs may be able ... What may help is to enable auditing of object access via security ... Even if an administrator is installing. ...
    (microsoft.public.windowsxp.security_admin)