Re: Win2k file share monitor

From: Peter Branch (pete@enisus.com)
Date: 03/21/02


Date: Thu, 21 Mar 2002 17:13:49 -0500
To: "Murtaza Nooruddin" <noorix@yahoo.com>, SECURITY-BASICS@securityfocus.com>
From: Peter Branch <pete@enisus.com>

Just enable auditing on the folders that you have shared. You will need
to enable 'object access' auditing in your security policy under the audit
policy. Then select the folders you want to audit and what specific
actions on those folders that you want to track. Just don't go too crazy
with auditing because it can become resource intensive after a while. All
specified access will be logged to the security log in the event viewer.

-Pete

At 01:37 AM 3/20/2002, you wrote:
>This might sound like a basic admin question. But is it possible in windows
>2000 to log or monitor file access (both normal and admin shares) via
>network.
>
>Can this be enabled or disabled, any security risks involved?
>
>
>
>_________________________________________________________
>Do You Yahoo!?
>Get your free @yahoo.com address at http://mail.yahoo.com



Relevant Pages

  • Re: auditing
    ... Enable auditing of account management will log the creation and changes to ... You can audit Directory Service access to audit OU's. ... This security setting determines whether to audit each event of account ... For specific instructions about how to configure auditing policy settings, ...
    (microsoft.public.win2000.active_directory)
  • RE: Sharing Folder and Files
    ... you need to enable Local Security Auditing and then auditing on your ... The audited entries can be viewed under Event Viewer --> Security. ... --> Enable auditing on your folders. ...
    (microsoft.public.win2000.file_system)
  • Re: XPP on Domain - can I make Directories private - even from Admin?
    ... You must enable Auditing for the machine. ... You must specify what to audit. ... Note that you can set a SACL on a file system object using the Security tab in that object's Properties dialog box. ...
    (microsoft.public.windowsxp.general)
  • Re: Deleting shortcuts when they are for a C: program
    ... Nothing to do with security works in Home but if you boot to safe mode security becomes available. ... Maybe auditing becomes available too. ... Set auditing for just this file. ... You must specify what to audit. ...
    (microsoft.public.windowsxp.general)
  • RE: Sharing Folder and Files
    ... I have enabled the local security auditing and auditing on ... my folders. ... double-click Audit ...
    (microsoft.public.win2000.file_system)