RE: Monitor File Access, Change or Delete
- From: v-robeli@xxxxxxxxxxxxxxxxxxxx (Robert Li [MSFT])
- Date: Tue, 13 Feb 2007 11:59:01 GMT
Hi,
Thanks for posting in our newsgroup.
From your description, I know that you want to audit access to a folder. IfI am off-base, please don't hesitate to let me know.
Base on my research, we can monitoring access, change, or delete files of a
folder with auditing for Windows Server 2003. To do this:
Step 1: Audit the user
1. Click Start, point to All Programs, point to Accessories, and then click
Windows Explorer.
2. Locate the file or folder that you want to audit.
3. Right-click the file or folder, click Properties, and then click the
Security tab.
4. Click Advanced, and then click the Auditing tab.
5. Perform one of the following tasks:
1) To set up auditing for a new user or group, click Add, type the name of
the user or group that you want to configure in the Enter the object name
to select box, and then click OK.
2) To remove auditing for an existing group or user, click the group or
user name, click Remove, click OK, and then skip the rest of this
procedure.
3) To view or change auditing for an existing group or user, click the
group or user name, and then click Edit.
6. In the Apply onto box, click This folder, subfolders and files.
7. In the Access box, select the appropriate check boxes to indicate the
actions you want to audit:
List Folder/Read data select Success Fail and Failed.
Change File/Write Date Select Success and Failed.
Delete Subfolder and Files select Success Fail and Failed.
Delete select Success Fail and Failed
8. If you want to prevent subsequent files and subfolders of the original
object from inheriting these audit settings, click to select the Apply
these auditing entries to objects and/or containers within this container
only check box.
9. Click OK 3 times.
For more information, please refer to:
How to set up and manage operation-based auditing for Windows Server 2003,
Enterprise Edition
http://support.microsoft.com/kb/325898
Step 2: Step 3: Verify the result
Start Windows XP machine and use logon to the domain. Visit the shared
folder you want to audit and delete one file.
On the SBS 2003 serer, open the Event Viewer to see the security log, you
can see the Event ID 560 is logged .
Hope above information help.
If you need further assistance, please don't hesitate to let me know.
Best regards,
Robert Li(MSFT)
Microsoft CSS Online Newsgroup Support
Get Secure! - www.microsoft.com/security
=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx
When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.
Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.
For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
<Thread-Topic: Monitor File Access, Change or Delete
<thread-index: AcdOygc/rBYcwfizQ8mcQisHrlqeHw==
<X-WBNR-Posting-Host: 66.215.214.47
<From: =?Utf-8?B?WmFmYWNvbg==?= <Zafacon@xxxxxxxxxxxxxxxxxxxxxxxxx>
<Subject: Monitor File Access, Change or Delete
<Date: Mon, 12 Feb 2007 09:20:01 -0800
<Lines: 3
<Message-ID: <DF7DA225-9769-4211-AF92-B1BA29075735@xxxxxxxxxxxxx>
<MIME-Version: 1.0
<Content-Type: text/plain;
< charset="Utf-8"
<Content-Transfer-Encoding: 7bit
<X-Newsreader: Microsoft CDO for Windows 2000
<Content-Class: urn:content-classes:message
<Importance: normal
<Priority: normal
<X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.2757
<Newsgroups: microsoft.public.windows.server.sbs
<Path: TK2MSFTNGHUB02.phx.gbl
<Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:16507
<NNTP-Posting-Host: tk2msftibfm01.phx.gbl 10.40.244.149
<X-Tomcat-NG: microsoft.public.windows.server.sbs
<
<I have a client that would like to monitor when employess access, change
or
<delete files on the SBS 2003 R2 Server. How can I do this? Do I need a
3rd
<part app? Thank you in advance.
<
.
- Follow-Ups:
- RE: Monitor File Access, Change or Delete
- From: Zafacon
- RE: Monitor File Access, Change or Delete
- Prev by Date: RE: Email not received - PRMD (p) wrong
- Next by Date: Re: IIS logs for Exchange/OMA Access
- Previous by thread: RE: unable to route thru server
- Next by thread: RE: Monitor File Access, Change or Delete
- Index(es):
Relevant Pages
|
