Re: Need to monitor Deleted files on server shares

Tech-Archive recommends: Fix windows errors by optimizing your registry

In article <#SnGproSJHA.1164@xxxxxxxxxxxxxxxxxxxx>,
gwdibble@xxxxxxxxxxxxxxxxxxxxxx says...
I know a free but really ugly, almost ineffective way to to this that's not
all that much worse than a root canal. Go to the Domain Controller Security
Policy (or your GPO of choice), Audit Policy -> Audit Object Access, and
choose Success. Now go to the top level folder, Properties -> Security ->
Advanced and go to the Audit tab. Add a security group or whatever and
configure what you want logged for that group (Delete, for example). Do the
inheritance thing to apply the setting to subfolders and files, it works
just like a regular ACL. Gpupdate /force and you'll be good to go.

What makes this ugly IMO is that auditing object access creates a boatload
of entries, and when someone deletes a file, the log entry isn't overly
informative (I'm not sure it even contains the name of the deleted file).
At least it shouldn't take you long to configure this and see if it's worth
pursuing for the limited purpose of catching who's deleting the files.

Thanks, we have that implemented, but, as you say, it's logging a LOT of
events.

Do you know of any other methods that might be friendly for company
owners and not just us IT types :-)

Thanks.

--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@xxxxxxxxxx (remove 999 for proper email address)
.

Relevant Pages

  • "Enter Network Password" popup on all IE pages
    ... gave up last night on this and began reimaging server. ... The audit policy on that local ... objects and they all read Ok as to the audit policy. ... >domain workstation accounts. ...
    (microsoft.public.win2000.group_policy)
  • Re: setting up an audit.
    ... Audit can be configured in a Group Policy, You may have a look at the links ... This module describes how to set different settings that apply to auditing. ... Threats and Countermeasures Guide - Audit Policy ... Microsoft Windows XP - Audit Policy ...
    (microsoft.public.windows.group_policy)
  • Re: Audit
    ... Audit can be configured in a Group Policy, You may have a look at the links ... This module describes how to set different settings that apply to auditing. ... Threats and Countermeasures Guide - Audit Policy ... Microsoft Windows XP - Audit Policy ...
    (microsoft.public.windows.server.active_directory)
  • Re: audit logons
    ... Audit can be configured in a Group Policy, You may have a look at the links ... This module describes how to set different settings that apply to auditing. ... Threats and Countermeasures Guide - Audit Policy ... Microsoft Windows XP - Audit Policy ...
    (microsoft.public.win2000.active_directory)
  • RE: Audit Policy - Default Domain Controller Security Settings
    ... Default Domain Controller Security Settings: ... Audit account logon events "Success" ...
    (microsoft.public.windows.server.sbs)