RE: Tracking File Modifications by User?
- From: v-crinal@xxxxxxxxxxxxxxxxxxxx ("Crina Li")
- Date: Tue, 08 Aug 2006 06:20:48 GMT
Hi,
Thank you for posting in SBS newsgroup.
According to your description, I understand that you would like to know how
to log the access or change to the folder on windows 2000. If I have
misunderstood your concerns, please do not hesitate to let me know.
Based on the information you provided, it should be a windows 2000 issue.
If you would, please post this question in the Microsoft.Public.Win2000
newsgroup. The reason why we recommend posting appropriately is you will
get the most qualified pool of respondents, and other partners who read the
newsgroups regularly can either share their knowledge or learn from your
interaction with us.
Also as I know, you can enable Audit log in Event log to do so. I provide
the detailed steps on SBS for your reference:
1. Click Start, click Run, type "gpmc.msc" and click OK.
2. Expand Domains -> your domain -> Domain Controllers.
3. Right-click Small Business Server Auditing Policy and click Edit.
4. Expand Computer Configuration -> Windows Settings -> Security Settings
-> Local Policies -> Audit Policy.
5. In the right pane, double-click "Audit object access".
6. To audit successful access of specified files, folders, select the
Success check box.
7. To audit unsuccessful access to these objects, select the Failure check
box.
8. To enable auditing of both, select both check boxes.
9. Click OK.
10. Run "gpupdate /force" or restart the computer so that the policy takes
effect on SBS.
After you enable auditing, you need to specify the files, folders that you
want audited. To do so:
1. In Windows Explorer, locate the file or folder you want to audit.
2. Right-click the file, folder that you want to audit, and then click
Properties.
3. Click the Security tab, and then click Advanced.
4. Click the Auditing tab, and then click Add.
5. In the "Enter the object name to select" box, type the name of the user
or group whose access you want to audit. You can browse the computer for
names by clicking Advanced, and then clicking Find Now in the "Select User
or Group" dialog box.
6. Click OK.
7. Select the Successful or Failed check boxes for the actions you want to
audit, and then click OK.
8. Click OK, and then click OK.
After that, you may check the Security event log to find the info you want.
Please Note: Frankly, checking the security event log to track which user
update certain public folder is not an easy way since there are bunch of
logs there.
More information:
174073 Auditing User Authentication
http://support.microsoft.com/?id=174073
Using Audit Policies to Secure Your Windows 2000 Network
http://whidbey.msdn.microsoft.com/library/default.asp?url=/library/en-us/dne
xnt00/html/ewn0054.asp
Securing Your Windows Small Business Server 2003 Network
http://www.microsoft.com/downloads/details.aspx?familyid=f62b2722-267c-4642-
b287-c31115ef10a4&displaylang=en
I hope the above information helps.
Thanks for your time and I look forward to your reply.
Best regards,
Crina Li (MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: Tracking File Modifications by User?
| thread-index: Aca57iA8dZ/q7EkSRYi64w0XyJRGUQ==
| X-WBNR-Posting-Host: 217.36.56.106
| From: =?Utf-8?B?U2tj?= <Skc@xxxxxxxxxxxxxxxxxxxxxxxxx>
| Subject: Tracking File Modifications by User?
| Date: Sun, 6 Aug 2006 23:53:02 -0700
| Lines: 14
| Message-ID: <D81DA0DE-C25D-40CA-B797-6B331FAC2EF5@xxxxxxxxxxxxx>
| MIME-Version: 1.0
| Content-Type: text/plain;
| charset="Utf-8"
| Content-Transfer-Encoding: 7bit
| X-Newsreader: Microsoft CDO for Windows 2000
| Content-Class: urn:content-classes:message
| Importance: normal
| Priority: normal
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.1830
| Newsgroups: microsoft.public.windows.server.sbs
| Path: TK2MSFTNGXA01.phx.gbl
| Xref: TK2MSFTNGXA01.phx.gbl microsoft.public.windows.server.sbs:287517
| NNTP-Posting-Host: TK2MSFTNGXA01.phx.gbl 10.40.2.250
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| I am running SBS2003 with a Windows 2000 Server running as a "member
server"
| with a role as file server.
|
| Clients map to the fileserver's drives via a login script. We host
various
| dBase5.7 files on one of the volumes (called "u:\") and the dBase
developer
| has noticed that someone has maliciously changed the .dbf files and/or
mdx
| index files.
|
| Is there an audit log file in Windows 2000 Server so that I can pinpoint
| which AD user it was?
|
| Thanks,
|
| S
|
.
- Prev by Date: RE: Public Folders
- Next by Date: SBS basic configuration hangs up
- Previous by thread: O.T. - another humor item
- Next by thread: SBS basic configuration hangs up
- Index(es):
Relevant Pages
|
