Re: Object auditing

From: linttrap (linttrap_at_discussions.microsoft.com)
Date: 04/21/05 

Date: Wed, 20 Apr 2005 21:48:02 -0700

This share is on a domain controller. The domain has multiple DCs.

"Steven L Umbach" wrote:

> Unless this share is on a domain controller, you will need to enable
> auditing of object access in the Local Security Policy or at the domain/OU
> level for the server offering the share. It would be best to use Local
> Security Policy if this is a single domain server that you want to enable it
> on. --- Steve
>
>
> "linttrap" <linttrap@discussions.microsoft.com> wrote in message
> news:DFE135E3-F1CA-48C1-B0F7-0B4A5E09DD27@microsoft.com...
> >I enabled audit object access on the Domain Controllers OU.
> >
> > "Chris Geier" wrote:
> >
> >> Did you enable audit object access in the local or domain security
> >> policy?
> >>
> >> "linttrap" wrote:
> >>
> >> > I set up auditing for file and folder deletion on a share yet it
> >> > doesn't show
> >> > up in Event Viewer.
> >> >
> >> > Here's my configuration:
> >> > I have a Windows 2003 DC with a couple of shares. I enabled auditing
> >> > via the
> >> > DC GPO. I followed the steps detailed on TechNet
> >> > (http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/ServerHelp/1940e00e-93eb-445d-90c7-285e0391eebb.mspx).
> >> > I used the Everyone group (previously I tried Domain USers). I ran a
> >> > gpupdate
> >> > /force and forced replication. Then I went to lunch and came back to
> >> > delete a
> >> > file on the share that has auditing enabled. I did not see anything in
> >> > the
> >> > security log. Help.
> >> >
> >> > Thanks in advance
>
>
>

Relevant Pages

  • Re: security log anomolies
    ... object access in particular can generate a huge amount of events especially ... auditing of account logons would be most ... overriding Local Security Policy. ... controllers in particular as Domain Controller Security Policy will override ...
    (microsoft.public.win2000.security)
  • Re: I cant logon to my server with an Administrator .
    ... There is a Local Security Policy on all domain computers, however defined settings in ... Domain Controller Security Policy will override Local Security Policy defined ...
    (microsoft.public.win2000.group_policy)
  • Re: W2K AutoLogon Feature (234562)
    ... Terminal Services on a domain controller. ... the user right under Local Security Policy. ... > logon portion, I get an error that says "The local policy ...
    (microsoft.public.win2000.security)
  • Re: I cant logon to my server with an Administrator .
    ... Mine is a DC with a AD so that's no any local security policy tho. ... Default Domain controller security settings. ...
    (microsoft.public.win2000.group_policy)
  • Re: security log anomolies
    ... > have both account logon and logon events enabled for success and failure. ... > overriding Local Security Policy. ... > controllers in particular as Domain Controller Security Policy will override ...
    (microsoft.public.win2000.security)