RE: Auditing File Deletion NOT WORKING

From: Jeff Qiu (jefffqiu@online.microsoft.com)
Date: 02/27/03 

From: jefffqiu@online.microsoft.com (Jeff Qiu)
Date: Thu, 27 Feb 2003 10:26:04 GMT

Hi Cameron,

Did that server join a domain? If you open the GPEDIT.msc in that server,
what the effective setting is for the following:
Local Computer Policy\Computer Configuration\Windows Settings\Security
Settings\Local Policies\Audit Policy\Audit object access

At the same time, because the changes that you make to your computer's
audit policy setting take effect only when the policy setting is propagated
(or applied) to your computer, complete one of the following steps to
initiate policy propagation:

1. Type "secedit /refreshpolicy machine_policy" (without the quotation
marks) at the command prompt, press ENTER, and then restart the computer.

2. Wait for automatic policy propagation, which occurs at regular
intervals that you can configure. By default, policy propagation occurs
every eight hours.

Regards,

Jeff Qiu
jefffqiu@online.microsoft.com
Online Support Professional
Microsoft Corporation

This posting is provided Ħ°AS ISĦħ with no warranties, and confers no
rights.

--------------------
>Reply-To: "Cameron Frasnelly" <networkmanage@premierwestbank.com>
>From: "Cameron Frasnelly" <networkmanage@premierwestbank.com>
>Subject: Auditing File Deletion NOT WORKING
>Date: Wed, 26 Feb 2003 13:57:43 -0800
>microsoft.public.win2000.security
>
>Hi there,
>
>We have object access success / failure turned on at the group policy level
>and on a specific server. We then turn auding for file deletion on for
>Everyone on a specific folder and apply to files and folders beneath it.
>Before deleting a file (just for testing) we check to make sure auditing is
>applied to it... it is. We then delete the file and receive no event in
any
>log for its deletion. We were expecting an event 564... but none.
>
>win2k server with sp3 and all the latest patches
>
>Any ideas would be greatly appreciated.
>
>Cameron
>
>
>

Relevant Pages

  • HELP - File Auditing
    ... We have "Audit Object Access" set to effective success and failure on all of ... If you open the GPEDIT.msc in that server, ... Wait for automatic policy propagation, ... Auditing File Deletion NOT WORKING ...
    (microsoft.public.win2000.security)
  • SBS2K Server, how to change local policy, auditing on. Make Effective Setting.
    ... I ran Microsoft's MBSA 1.2.1 and noticed that auditing was not on on one ... I turned auditing on for the domain on the server, ... Effective Setting set is "Audit Account Management." ... Was I supposed to instead of editing the default domain policy in Active ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: password change
    ... I would check group policy too (effective setting on PC). ... > I checked the account properties on the server and the user should be able ...
    (microsoft.public.win2000.networking)
  • Slow file deletion from shared folder
    ... W2K3 Std server with Exchange 2003 SP1 installed. ... files from the shared folders. ... the file deletion was delayed by 1 ...
    (microsoft.public.windows.file_system)
  • Re: DOD 5220 file deletion
    ... Not ships with the server but available from separately from ISVs. ... > Does the windows 2000 advanced server comply with or have ... > a tool to comply with the DOD 5220 file deletion spec for ...
    (microsoft.public.win2000.security)