Re: Auditing Attempted Shared Folder Access

NTFS auditing is controlled by enabling audit of Object Access
in the security policy, which you did not list as enabled.


"keith c" <keithc@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:2D131BA7-17AF-483E-8F33-410C2D98D26B@xxxxxxxxxxxxxxxx
I have Success/Failure turned on in the following Local Security Settings:
Audit Acct logon events
Audit Acct Management
Audit Directory Service Access
Audit Logon Events
Audit Policy Change

I have a shared folder on the server that has the following permissions
set
on it:
Security (local NTFS): Everyone Full Control
Sharing permissons: TestUser1 - Read Only

I have auditing set for "Everyone" of Type: Failure on the folder.

When TestUser2 (who doesnt have access to the folder) double clicks on
the share, the "Access is Denied" message box is displayed. But I have no
'failure' entry in the Security Event Log on the server.

What am I doing wrong? Am I missing something?
What do I need to do to get the failed attempt captured in the
security event log?

Any help would be appreciated.

Thanks
K C
Security Analyst III
Self Regional Healthcare
Greenwood, SC USA


.

Relevant Pages

  • Re: Event Log ID 538 and 540 continous
    ... I believe the Default Domain Controller Security Settings for SBS 2003 are ... set to 'Success' for "Audit Logon Events" and "Audit Account Logon" events. ... Turning on "Audit Logon Events" may generate a large log (on my test server, ... You may be able to switch to only activating "Audit Account Logon Events" ...
    (microsoft.public.windows.server.sbs)
  • Re: windows 2000 server auditing objects...
    ... You can enable auditing of logon events to track when a "user" logs onto a computer ... user logs onto the domain by viewing the security log in Event Viewer. ... You can also enable auditing of object access on a computer and then audit access to ...
    (microsoft.public.win2000.security)
  • Bad PAssword Attempts not logged
    ... I have the following setup user Domain Security Policy | ... Audit account logon events: Failure ...
    (microsoft.public.win2000.security)
  • RE: audit user logon activity
    ... Read any Windows Security guideline paper. ... Audit Logon events - This category is separate from the "Audit Account ... Security Identification Systems Corporation ...
    (Security-Basics)
  • RE: syslog
    ... For the same kind of environment, I am using Computer Associates eTrust ... Audit integrated with Security command center for an easy event management ... and consolidation of logs + administration of all the Security ...
    (Security-Basics)