Re: Auditing Object Access

Hello JohnB,

If the users have a domain user account, which i assume, because they use RDP to connect to the server, then open the folder properties where the data is stored, go to Security Tab and enable auditing on the folder, choose the user accounts or better create a group, move all user accounts to the group and add the group for auditing. Now you can see in the event log what the users have done.

BTW, using a DC for normal user logons as a Terminal server is a really bad decision from the point of security. A DC should always do it's main work and not be accessed by normal users. For this kind of application server/terminal server use a member server.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

This is kind of an usual situation; approximately 50 users whose
primary use of the network is to RDP into a server to use a company
application. It is a Windows 2003 server that was setup as a DC. The
clients are Vista and XP, all Home edition. So none of the computers
are joined to the domain (I know, unusual).

The server is backed up at night by Scheduler using xcopy in a batch
file. Everything seems to work fine with the backup.

But, almost every day, files and sub-folders turn up missing from one
particular folder on the server. They are primarily Word and Excel
files (all accessed locally using RDP).

I redirect the output of the xcopy commands to a text file. Today
when someone reported files missing from the folder, I looked at that
backup log and could tell the number of sub-folders was down
considerably from the day before.

My guess is this could be one of two things; either the xcopy command
is somehow *loosing* files/folders or, someone is accidentally
deleting or moving files during the day. I have never seen folders
come up missing after an xcopy. So am leaning towards the problem
being with a user moving/deleting them. I would like to use auditing
to find out if a user is responsible.

My question is: how do I use Auditing for Object Access if none of
the
computers are joined to the domain?
If they aren't, I can't configure the GP.
TIA



.

Relevant Pages

  • Re: Email enable doc lib
    ... navigate to the public folder and send some posts with attachments to the ... Microsoft CSS Online Newsgroup Support ... I have disabled forms base Athentication from the default V.Smtp server ...
    (microsoft.public.windows.server.sbs)
  • Re: howto access servers hdd remotely through RDP session? (MSTSC)
    ... You can share the folder on the server and with a logon script on ... And that's running on the server, not on the client. ... client, outside an rdp session? ...
    (microsoft.public.windows.terminal_services)
  • Re: IIS 6 and ACL entries
    ... > down the security so that only a few users can access this folder. ... I have some other user accounts with the exact same ... > auditing on the file server where the folder resides and the audit log ... > the request never made it to the file server. ...
    (microsoft.public.inetserver.iis)
  • Re: Newbie with a smallbiz2000 installation, check my config?
    ... > Windows creates a profile path under Documents & Settings. ... > a folder with that name already exists (maybe a local user with the ... > server, open the properties for this folder, and ensure that you have ... > you redirect key folders from a user's profile to a location on your ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Network shares cannot connect
    ... User Name: SERVER$ ... Regarding the shares accessing problem, I suggest you try following steps ... let's focus on the Users Shared Folder first. ... To check this permission, please click the Advanced button, select ...
    (microsoft.public.windows.server.sbs)
Quantcast