Re: Auditing object access fill security log with EventID 562 for Exchange

Thanks Susan

Out of interest, what file size did you settle on - mine is currently 64MB
with +190,000 entries.

Thanks again.

Matt


"Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@xxxxxxxxxxx>
wrote in message news:OrLIr4%23NGHA.420@xxxxxxxxxxxxxxxxxxxxxxx
I increased the log file size :-)

Matt Woodman wrote:

Hi

I need to enable audit of object access in order to monitor users moving
or deleting shared files/folders.

When I set this in Group Policy the server security log is filled with
entries for Exchange:-

Event Type: Success Audit
Event Source: Security
Event Category: Object Access
Event ID: 562
Date: 22/02/2006
Time: 12:32:25
User: NT AUTHORITY\SYSTEM
Computer: WS02SERVER
Description:
Handle Closed:
Object Server: Microsoft Exchange
Handle ID: 17691120
Process ID: 4480
Image File Name: C:\Program Files\Exchsrvr\bin\store.exe


For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

These entries appear every couple of seconds, which means that the log
rapidly fills up.

Is there any way I can stop these events from being recorded?

Thanks

Matt Woodman




.

Relevant Pages

  • Re: Auditing object access fill security log with EventID 562 for Exchange
    ... Matt Woodman wrote: ... I need to enable audit of object access in order to monitor users moving or deleting shared files/folders. ...
    (microsoft.public.windows.server.sbs)
  • Re: Audit Object Access
    ... object access can generate a lot of entries because W2K will do auto ... security policy for the effective setting under security options for "audit ... > Object Server: Security ...
    (microsoft.public.win2000.security)
  • Re: track who accessed/deleted a file/folder.
    ... You can enable auditing of object access and then audit specific files/folders for ... but it does generate a huge amount of ... entries so you may want to use it sparingly. ... > have setup audit in win2k, ...
    (microsoft.public.win2000.security)
  • Re: track who accessed/deleted a file/folder.
    ... >You can enable auditing of object access and then audit ... >entries so you may want to use it sparingly. ... to filter for certain for ... >> have setup audit in win2k, ...
    (microsoft.public.win2000.security)