RE: Enabling Auditing for files and folders

Hello there,

Thank you for posting to the SBS Newsgroup.

I understand that you want to audit files and folders on SBS 2K3, and you
have created "Local Computer Policy" in Group Policy Object Editor.

Actually, if you want to audit the file access on the SBS server, you
should enable the policies in the Default Domain Controller GPO or a GPO
linked to the DC container.

1. Go to Start, Programs, Administrative Tools, Domain Controller Security
Policy.

2. Now you are in the Default Domain Controller Security Setting.

3. Expand Security Settings\Local Policies\Audit Policy.

4. On the right panel, enable the "Audit object access" policy.

5. Run "gpupdate" in a command prompt.

6. Go to the files and folders that you want to audit, right click it and
select Properties.

7. Go to Security tab, click Advanced, go to Auditing Tab.

8. Check the two boxes under Add and then click Add.

9. Enter the object name in the blank, and click OK.

10. Test whether it works now.

For the detailed steps, please refer to the following KB articles for
detailed information.

How To Set, View, Change, or Remove Auditing for a File or Folder in
Windows 2000
http://support.microsoft.com/kb/301640/en-us

HOW TO: Set Up and Manage Operation-Based Auditing for Windows Server 2003,
Enterprise Edition
http://support.microsoft.com/?id=325898

Thanks for your time. I am looking forward to your reply.

Best regards,

Brandy Nee

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

.

Relevant Pages

  • RE: audit user activity
    ... you can enable Audit log in Event log on SBS: ... double-click "Audit object access". ... To audit successful access of specified files, folders, select the ... Microsoft CSS Online Newsgroup Support ...
    (microsoft.public.windows.server.sbs)
  • RE: Auditing file deletion
    ... regarding this in the security event log. ... Default Domain Controllers Policy. ... Click Computer Configuration, double-click Windows Settings, ... double-click Audit Policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: Auditing file deletion
    ... The problem is that hundreds of other Object Access events get logged, ... just the file and directory deletions. ... Default Domain Controllers Policy. ... double-click Audit Policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: I need a Step-by-Step to set up file deletion Auditing on SBS...
    ... Default Domain Controllers Policy. ... Right-click Domain Controllers, click Properties. ... Click Computer Configuration, double-click Windows Settings, double-click ... Audit Policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: Event Logs/Event Viewer
    ... That works for Pro but Home has no group policy editor. ... Set both Audit account logon events & Audit logon events for Success & ...
    (microsoft.public.windowsxp.general)