RE: Auditing object access from network

From: Cherry Qian (cherryq_at_online.microsoft.com)
Date: 08/13/03 

Date: Wed, 13 Aug 2003 05:41:43 GMT

Hi Ken,

Thank you for the posting. As you indicated you are trying to audit object
access for a few specific directories and files.

Before Windows 2000 can audit access to files and folders, you must use the
Group Policy snap-in to enable the Audit Object Access setting in the Audit
policy. If you do not, you receive an error message when you set up
auditing for files and folders, and no files or folders will be audited.
After auditing is enabled in Group Policy, view the security log in Event
Viewer to review successful or failed attempts to access the audited files
and folders.

This step-by-step article provides information about how to set, view,
change, or remove auditing for a file or folder in Microsoft Windows 2000.
301640 HOW TO: Set, View, Change, or Remove Auditing for a File or Folder in
http://support.microsoft.com/?id=301640

For more information, please refer to the following knowledge base
articles.

314955 HOW TO: Audit Active Directory Objects in Windows 2000
http://support.microsoft.com/?id=314955

300549 HOW TO: Enable and Apply Security Auditing in Windows 2000
http://support.microsoft.com/?id=300549

Hope the above information and suggestion helps and answers your question.
If anything is unclear, please let me know.

Sincerely,
 
Cherry Qian
MCSE2000, MCSA2000, MCDBA2000
Microsoft Partner Online Support
 
 
Get Secure! - www.microsoft.com/security
 
====================================================
When responding to posts, please Reply to Group via your newsreader so
that others may learn and benefit from your issue.
====================================================
This posting is provided AS IS with no warranties, and confers no rights.

Relevant Pages

  • Re: Last to Modify
    ... The audit log question is moot though unless you have AD changes being logged ... Joe Richards Microsoft MVP Windows Server Directory Services ... >>To track changes within Active Directory you have to enable auditing. ... >>to track user activities and system-wide events in Active Directory. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Last to Modify
    ... least point the audit log to a specific time? ... > To track changes within Active Directory you have to enable auditing. ... > Microsoft Windows XP - Audit Policy ...
    (microsoft.public.windows.server.active_directory)
  • RE: Monitor File Access, Change or Delete
    ... folder with auditing for Windows Server 2003. ... Locate the file or folder that you want to audit. ... and then click the Auditing tab. ...
    (microsoft.public.windows.server.sbs)
  • Re: Printer Disapear and Strange Admin Objects
    ... Printers disappearing from Active Directory: ... This module describes how to set different settings that apply to auditing. ... It also provides an example of audit events created by several common tasks. ... Microsoft Windows XP - Audit Policy ...
    (microsoft.public.windows.server.active_directory)
  • Re: Auditing changes in AD objects?
    ... This module describes how to set different settings that apply to auditing. ... It also provides an example of audit events created by several common tasks. ... Microsoft Windows XP - Audit Policy ... to track user activities and system-wide events in Active Directory. ...
    (microsoft.public.windows.server.active_directory)